When the wizard asks for a webhook URL, it's giving Ship a place to receive these notifications from the provider. The provider stores that URL and calls it whenever there's an event. To ensure that Ship trusts the notification actually came from the provider (and not from someone pretending to be the provider), the provider includes an HMAC signature on each call—a cryptographic stamp that proves the message came from them. Ship verifies the signature before processing the event.
Back to Appendix index