Webhook In: POST records straight into a table — Security

The URL is unguessable and acts as the credential — treat it like a password. Pausing the endpoint makes the URL answer 404 until you resume it; deleting it is permanent, though the records it created are untouched. For senders that can compute an HMAC, tick Require signatures: each POST must then carry X-RowFold-Signature: t=,v1=hex(HMAC_SHA256(secret, ".")) with the timestamp within five minutes, and anything unsigned or mis-signed gets a 401. It is the exact scheme RowFold's outgoing webhooks sign with, so one implementation covers both directions. The secret can be rotated at any time — that is the leak response — and rotation only breaks senders while enforcement is on. POSTs are rate-limited per sender address, and a body is capped at 128 KB.