Iris.Md logoIris.Md
← All channels

Webhook

stable

Generic HTTP in. Trigger the agent from anything.

In
✓
Out
—
Auth
HMAC signature
§ Required environment

Env vars

IRIS_WEBHOOK_SECRET
Required

Shared secret used to verify HMAC signatures on incoming requests.

§ Setup

Step by step

  1. 01

    Pick a secret

    Pick a long random string and export it as IRIS_WEBHOOK_SECRET.

  2. 02

    Sign requests

    Senders include an X-Iris-Signature header containing HMAC-SHA256(body, secret).

    curl -X POST https://your-host/api/public/webhook \
  -H "X-Iris-Signature: $(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | cut -d' ' -f2)" \
  -d "$BODY"
§ Success

You're done when

  • ✓IRIS_WEBHOOK_SECRET is set and not committed to git
  • ✓Unsigned requests return 401
  • ✓Signed requests reach the agent and are auditable in iris logs