Repository navigation
Allow to pass auth headers to webhook call #413
Description
Is your feature request related to a problem? Please describe.
I want to make sure that the "caller" of a webhook endpoint is a valid caller.
Describe the solution you'd like
I would like to expand the webhook field, so it can be an object with url, headers and any other requests optionsrequests params
Additional context
Passing only the webhook url can expose it to unauthorized access.
Reacted by obiwann and robi
Activity
robertpikmets commentedon Nov 26, 2025
I'd also like to emphasize this. Current common approach of passing on the webhook "secret" as a query parameter poses a security risk unfortunately.
felixmosh commentedon Nov 26, 2025
@robertpikmets , so do you agree with me?
What other options do we have?
What security risk it poses?
dereoprojects commentedon Nov 26, 2025
query parameters are not well protected and can be looked up via web trackers. I propose asymmetric encryption on this. /run request accepts a public key in the body and the runpod servers will encrypt the actual body with the key provided, and send it in the header. It will also send the actual body. Request owner will use its private key to decrypt. and compare the value to actual body to guarantee authority.
felixmosh commentedon Nov 26, 2025
Currently, I'm attaching an accessToken (jwt with expiration) to the webhook url...
felixmosh commentedon Jul 22, 2026
Any update regarding this?