Defense in depth

Treat webhook requests as unauthenticated until the Standard Webhooks signature and timestamp pass.
Keep the endpoint secret in a secret manager, restrict access to it, and rotate immediately after
suspected disclosure.

Your receiver should:

• terminate TLS with a publicly trusted certificate;
• accept only POST at the configured path;
• cap request bytes before buffering;
• verify the exact raw body and five-minute timestamp tolerance;
• deduplicate event_id atomically;
• enqueue work and return 2xx within 15 seconds;
• avoid logging bodies, signing secrets, or signature headers.

Endpoint URLs must use HTTPS. Oway rejects credentials in URLs, non-public DNS answers, IP-literal
hosts, private, loopback, link-local, multicast, and cloud-metadata addresses. The destination must remain public for every delivery attempt. Redirects are never followed.

Oway egress addresses

If your firewall uses source allowlists, allow every address listed for the environment.

The addresses are reserved static IPs. Signature verification remains mandatory;
an IP allowlist is an additional network control, not request authentication.

Secret rotation

During the 24-hour overlap, verify with both your new and previous secret. Oway emits one v1
signature for each eligible key. Remove the previous key only after the endpoint's
previous_secret_expires_at time.