Authenticating webhooks: Header secret and HMAC secret

The authentication method for webhooks is determined by the vendor application. 

Tip
When you add a webhook, you will know the type of authentication that is required by the name of the secret. 

The two types of authentication supported by vendor applications for webhooks are:

• Header secret
• HMAC secret

Header secret. The header secret comprises a header key and value. The header key is Authorization and the value is the value that you enter for the Header Secret when you create the webhook in Oomnitza.

In this example, you set up the authentication when you add the event hook in Okta. You enter Authorization in the Authentication field and you enter the value that you entered in the Header Secret for the webhook in Oomnitza as the authentication secret in Okta. 

HMAC (Hash-based Message Authentication Code) Secret. If the vendor application uses HMAC to generate the authentication secret, you must use the secret generated by the vendor application as the HMAC Secret in Oomnitza.

Process for creating webhooks

Event hooks that require Header Secret authentication:

1. First, create the webhook in Oomnitza.
   1. Copy the Header secret that you enter.
   2. Make your changes and copy the webhook URL which is generated when the webhook is saved.
2. Second, create the event hook in the vendor application.
   1. The name of the header field for authentication is Authorization.
   2. The secret is the Header Secret that you entered for the webhook in Oomnitza. 

Event hooks that require HMAC Header authentication:

1. Log into Oomnitza, and create but do not save the webhook.
2. Log into the vendor application and create the hook event.
3. In the vendor application, complete these actions:
   1. Generate the secret.
   2. Copy the secret.
   3. Enter the secret into the HMAC Header for the webhook In Oomnitza.
4. Complete the configuration of the webhook in Oomnitza and copy the webhook URL.
5. Complete the configuration of the hook event in the vendor application.