2.4.0
Signed, timestamped webhooks, and the old header deprecated
Webhooks now carry a Runnel-Signature header with a timestamp, so captured requests can't be replayed. X-Runnel-Signature is deprecated and goes in 3.0.
- Improved
- Deprecated
The Runnel-Signature header
Every webhook request now carries a Runnel-Signature header in the form t=<unix time>,v1=<signature>. The signature is an HMAC-SHA256 of the timestamp, a full stop and the raw body. Because the time is signed, you can reject requests older than five minutes, which stops anyone who captured a request from sending it again later.
The SDKs check both the signature and the age:
const event = runnel.webhooks.verify(rawBody, req.headers.get('runnel-signature'), process.env.RUNNEL_WEBHOOK_SECRET!);Secret rotation
You can now rotate an endpoint’s secret without downtime. For 24 hours after a rotation, the header carries two v1 signatures, one per secret, and the SDKs accept either.
Deprecated: X-Runnel-Signature
The old X-Runnel-Signature header signed only the body, with no timestamp. We will keep sending it alongside the new one until Runnel 3.0, and then remove it. SDK versions before 2.4 read only the old header, so upgrade the SDK in your webhook handler first. See Webhooks for the details.
Fixes
run.retryingwas sent twice when an attempt timed out.- The webhook log now shows the response body your endpoint returned, up to 2 KB.