We added a new authentication system for webhooks, as an alternative to webhook secrets. Now, you can configure a webhook's access control to be:

• "Anyone with the path" (no secret, no authentication system)

• "Anyone with the secret" (the current default method)

• "Only team members" (new!)

• "Members of this Tines tenant" (new!)

In the case of "team" or "tenant" member access control, requests to the webhook must include an Authorization HTTP header with a valid Tines API Key. This way, you can restrict access to the webhook without sharing a static secret, get the benefits of API key management, and identify the user that made the request in the downstream event.

Learn more about webhook authentication and authorization in our webhook docs.