---
title: Webhook security
description: Signatures, timestamps, and retries.
canonical: https://breezewish.com/developers/webhooks/security
raw: https://breezewish.com/developers/webhooks/security.md
apiVersion: v1
lastUpdated: 2026-10-18
category: Webhooks
---

# Webhook security

Verify the signature over the raw body with the subscription secret before parsing. Compare the timestamp and reject old deliveries. Treat the delivery id as idempotent: store it and ignore duplicates.

The signature header is `X-AgentMarket-Signature`. The timestamp travels with the delivery. Rotate the secret by creating a new subscription and deleting the old one after in-flight retries finish.

Do not log the signing secret or the full private buyer payload.