Inbound webhooks

Create github app

POST/hooks/github-app

#Authentication

Issuer signature

No bearer credential: the caller proves itself by signing the raw request body. Anything that does not verify is refused (or, on the card rail, declined) before the body is read.

Request

curl -X POST "https://immiscible.fly.dev/hooks/github-app" \
  -H "x-hub-signature-256: $SIGNATURE"

// signature: computed over the raw body, see the authentication note above
const res = await fetch('https://immiscible.fly.dev/hooks/github-app', {
  method: 'POST',
  headers: {
    'x-hub-signature-256': signature,
  },
});
const data = await res.json();
console.log(res.status, data);

import requests

# signature: computed over the raw body, see the authentication note above
res = requests.post(
    "https://immiscible.fly.dev/hooks/github-app",
    headers={
        "x-hub-signature-256": signature,
    },
)
print(res.status_code, res.json())