--- title: "Webhook signatures: shared key retired, unproven endpoints stop: Trooth changelog - Trooth" description: "Webhooks are signed per endpoint with a version 2 signature. The shared signing key is retired on 2026-09-28, and endpoints that have not proven ownership stop receiving on 2026-10-05." canonical_url: "https://trooth.co/changelog/2026-09-26-webhook-signatures-v2" markdown_url: "https://trooth.co/changelog/2026-09-26-webhook-signatures-v2.md" generated_from: "the rendered page, converted to Markdown when this was requested" agent_index: "https://trooth.co/llms.txt" --- [Back to changelog](https://trooth.co/changelog) Security September 26, 20261 minute read # Webhook signatures: shared key retired, unproven endpoints stop Webhooks are signed per endpoint with a version 2 signature. The shared signing key is retired on 2026-09-28, and endpoints that have not proven ownership stop receiving on 2026-10-05. ## What changed Webhooks are now signed per endpoint with a version 2 signature over the delivery timestamp and body, sent in the x-trooth-signature-v2 and x-trooth-delivery-timestamp headers. Deliveries are tried three times with a five-second timeout and do not follow redirects. The shared signing key is retired on 2026-09-28; deliveries signed with it continue for seven days after that so receivers can move. From 2026-10-05, a webhook endpoint that has not answered the ownership challenge receives nothing. ## Why it changed One shared key signed every endpoint's deliveries, and deliveries went to endpoints whose owners had never proven control of them. ## Who is affected - **Affected:** Anyone receiving Trooth webhooks in a company workspace. Readers of public profiles are not affected. - **Availability:** Company workspaces with webhook endpoints. - **Release stage:** Available. - **Areas:** Webhooks, Company workspace. ## What to do **Action required by October 5, 2026.** Verify x-trooth-signature-v2 with your endpoint's own secret, and answer the ownership challenge, before 2026-10-05. After that date an unproven endpoint receives nothing and no delivery carries the shared-key signature. - **September 28, 2026:** Shared webhook signing key retired. - **October 5, 2026:** Unproven webhook endpoints stop receiving; shared-key deliveries end. ## Security details - **Affected:** Receivers verifying the version 1 signature made with the shared signing key, and endpoints that never answered the ownership challenge. - **Fixed in:** A version 2 signature per endpoint, x-trooth-signature-v2, over x-trooth-delivery-timestamp, a full stop and the raw body. - **Required action:** Verify x-trooth-signature-v2 with your endpoint's own secret, and answer the ownership challenge, before 2026-10-05. After that date an unproven endpoint receives nothing and no delivery carries the shared-key signature. - **Advisory:** [Webhook reference](https://trooth.co/docs/webhooks) ## Versions and migration Before: ``` // Version 1: one shared key for every endpointconst ok = hmac(SHARED_KEY, rawBody) === headers["x-trooth-signature"]; ``` After: ``` // Version 2: your endpoint's own secret, over the timestamp and the bodyconst ts = headers["x-trooth-delivery-timestamp"];const expected = "v2=" + hmac(ENDPOINT_SECRET, `${ts}.${rawBody}`);const ok = expected === headers["x-trooth-signature-v2"]; ``` ## Dates - **Announced:** September 26, 2026, the day this entry was written. Entries are never backdated. - **Released:** September 26, 2026. - **Shared key retired:** September 28, 2026. - **Unproven endpoints stop:** October 5, 2026. ## What this does not fix This release does not email the owners of endpoints still on the shared key. That notice is a separate step and has not been sent as of this entry. ## Read more - [Webhook reference](https://trooth.co/docs/webhooks) On this page - What changed - Why it changed - Who is affected - What to do - Security details - Versions and migration - Dates - What this does not fix - Read more [Security](https://trooth.co/changelog?type=security)[Deprecation](https://trooth.co/changelog?type=deprecation)[Webhooks](https://trooth.co/changelog?area=webhooks)[Company workspace](https://trooth.co/changelog?area=workspace) [Back to changelog](https://trooth.co/changelog) ## Related changes - [JUL.25NewRegister views, severity-true sorting, CSV evidence exportsCompany workspace](https://trooth.co/changelog/2026-07-25-register-views) - [JUL.24NewModel Context Protocol server, incident ledger, ML-BOM export, Guard policy centerMCP server +2](https://trooth.co/changelog/2026-07-24-mcp-server-incident-ledger) - [JUL.24NewAPI keys, live outside-in reads, dispute path, /verifyAPI +2](https://trooth.co/changelog/2026-07-24-api-keys-live-reads) - [JUL.24NewPeople, Access Reviews, policy acceptance, Auditor Portal, vendor-network recordCompany workspace](https://trooth.co/changelog/2026-07-24-people-access-reviews) - [SEP.27NewA public feedback board, and a comparison you can start with any two companiesNetwork +1](https://trooth.co/changelog/2026-09-27-feedback-board-and-comparison) - [SEP.27ImprovementA developer reference you can build from, and a changelog you can followAPI +1](https://trooth.co/changelog/2026-09-27-developer-reference-and-changelog) ## Follow what changes at Trooth Every entry by email, or a feed narrowed to one area or to the changes that need you to act. ## Product updates by email Occasional notes when something on this page changes. You get one confirmation email when you subscribe, every email carries an unsubscribe link, and the address is never sold or shared. Email address [RSS](https://trooth.co/changelog/rss.xml)[Webhooks only](https://trooth.co/changelog/rss.xml?area=webhooks)[Needs action](https://trooth.co/changelog/rss.xml?action=required) ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://trooth.co/#org", "name": "Trooth", "legalName": "Trooth, LLC", "alternateName": [ "Trooth, LLC", "Trooth Network", "trooth.co" ], "url": "https://trooth.co", "logo": { "@type": "ImageObject", "@id": "https://trooth.co/#logo", "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "width": 1024, "height": 1024, "caption": "Trooth" }, "image": { "@id": "https://trooth.co/#logo" }, "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current, evidence-backed Machine-Readable Trust Profile per company, rechecked on a schedule and signed so it can be replayed.", "foundingDate": "2025-12-16", "address": { "@type": "PostalAddress", "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174", "addressLocality": "Miami", "addressRegion": "FL", "postalCode": "33131", "addressCountry": "US" }, "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "hello@trooth.co", "url": "https://trooth.co/contact" }, "sameAs": [ "https://x.com/Troothllc", "https://github.com/troothllc", "https://www.crunchbase.com/organization/trooth", "https://www.wikidata.org/wiki/Q141292994", "https://www.youtube.com/@Troothllc", "https://www.trustpilot.com/review/trooth.co" ] }, { "@type": "WebSite", "@id": "https://trooth.co/#website", "url": "https://trooth.co", "name": "Trooth", "alternateName": "Trooth Network", "inLanguage": "en", "publisher": { "@id": "https://trooth.co/#org" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://trooth.co/network?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "ItemList", "@id": "https://trooth.co/#sitelinks", "name": "Trooth sitelinks", "itemListElement": [ { "@type": "SiteNavigationElement", "position": 1, "name": "Join Trooth now - it's free!", "url": "https://trooth.co/signup" }, { "@type": "SiteNavigationElement", "position": 2, "name": "Company, Trooth", "url": "https://trooth.co/network/company/trooth" }, { "@type": "SiteNavigationElement", "position": 3, "name": "Trooth Network", "url": "https://trooth.co/network" } ] } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trooth.co/" }, { "@type": "ListItem", "position": 2, "name": "Changelog", "item": "https://trooth.co/changelog" }, { "@type": "ListItem", "position": 3, "name": "Webhook signatures: shared key retired, unproven endpoints stop", "item": "https://trooth.co/changelog/2026-09-26-webhook-signatures-v2" } ] } ```