Logs and Security
Monitor webhook deliveries and verify payloads using HMAC signatures for secure integrations.
Delivery logs
Every webhook delivery is logged with the request payload, response status, and success indicator. View delivery logs from the webhook settings page.
Successful deliveriesHTTP responses with 2xx status codes are marked as successful.
Failed deliveriesNon-2xx responses or connection errors are logged with the response body for debugging.
Log retention
Delivery logs are retained based on your plan:
Standard plans — 30 days
Enterprise plans — 90 days
Signature verification
Every webhook request includes an X-Bit-Signature header containing an HMAC SHA-256 hex digest of the request body, signed with your webhook's secret key.
To verify a delivery:
1
Get your secretClick "Reveal secret" on the webhook details page to copy your signing secret.
2
Compute the signatureCompute HMAC SHA-256 of the raw request body using your secret as the key.
3
CompareUse a constant-time comparison to match the computed signature against the
X-Bit-Signature header value.Request headers
Every webhook delivery includes these headers:
X-Bit-Signature — HMAC SHA-256 hex digestContent-Type — application/jsonUser-Agent — @teambit/dot-webhooksAny custom headers you configured are also included.