How do I make sure an incoming webhook is really from the source?

Open webhook endpoints accept any request. An attacker who knows the URL can feed your flow fake data. HMAC signing in the header is the standard fix, IP allowlist is a second layer.

Try this first

1. 1Ask the source (Stripe, GitHub, Mollie, Shopify) to enable signing-secret and store the secret in a vault, not in the flow step itself.
2. 2In the first flow step compute HMAC over the raw body with that secret and compare to the signature header. Mismatch means stop immediately.
3. 3Use a time window of for example 5 minutes on the payload timestamp, otherwise a leaked old request stays replayable.
4. 4Where possible add an IP allowlist for known source ranges, especially payment providers that publish their IPs.
5. 5Log every rejected request separately, that is your early warning someone is guessing or abusing the URL.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.