GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — docs(webhooks): document additionalSignatureHeaders for custom HMAC sources by mintlify[bot] · Pull Request #5045 · triggerdotdev/trigger.dev

Conversation

mintlify Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Summary

The custom providers section now explains additionalSignatureHeaders. You can use it to accept an HMAC signature from up to 4 extra headers, for example when a provider sends a second signature signed with the previous secret during a rotation.

Based on feat(webapp,webhook-engine): keep the old webhook signing secret valid during rotation, which added the option to HMAC verifier configs. The paragraph also points to the built-in hookdeck() source from feat(core,sdk): webhooks.hookdeck() source, which already handles X-Hookdeck-Signature-2.

The rotation grace period edits to the connect page and OpenAPI spec are dropped. Eric already covered them in previousSecretTtlSeconds in the API client and MCP tools.

Docs only. Mark ready for review to merge.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          docs(webhooks): document signing secret rotation grace period

57c4c76

mintlify Bot assigned ericallam

Oct 21, 2026

mintlify Bot requested a review from ericallam

October 21, 2026 10:09

changeset-bot Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

⚠️ No Changeset found

Latest commit: d574cf3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 8dd0c00e-fd96-4317-a14a-ee1709647961

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

ericallam approved these changes

Oct 21, 2026

View reviewed changes

ericallam marked this pull request as ready for review

October 21, 2026 10:49

devin-ai-integration Bot reviewed

Oct 21, 2026

View reviewed changes

devin-ai-integration Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 2 potential issues.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

docs/webhooks/connect.mdx Outdated


		The rotate and regenerate dialogs include Keep accepting the old signing secret for (or the old public key). Trigger.dev keeps verifying deliveries signed with the old credential until that time passes, so you can update the provider without failing deliveries. Choose 1 hour, 24 hours (the default) or 7 days. Choose Stop immediately if the old credential leaked.

		Over the API, pass `previousSecretTtlSeconds` (up to `604800`, 7 days) to [generate a secret](/management/webhooks/generate-secret) or [set a secret](/management/webhooks/set-secret). The response includes `previousSecretExpiresAt`. Without `previousSecretTtlSeconds`, the old secret stops verifying immediately.

devin-ai-integration Bot Oct 21, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Expiry field is conditional

The API omits previousSecretExpiresAt when no old credential survives rotation. The unconditional response wording can mislead callers on first-time setup or immediate replacement.

Was this helpful? React with 👍 or 👎 to provide feedback.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

docs/webhooks/sources.mdx Outdated

		});
		```

		To accept a signature from more than one header, list the extra headers in `additionalSignatureHeaders` (up to 4). Trigger.dev parses them like `signatureHeader` and accepts a match in any of them. This keeps deliveries verifying when a provider sends a second signature during a secret rotation, such as Hookdeck's `x-hookdeck-signature-2`. `signatureHeader` is still required.

devin-ai-integration Bot Oct 21, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Primary signature header remains mandatory per request

An additional header alone cannot verify a delivery: prepareSignedVerification rejects missing or unparseable primary signatures first. Clarifying this constraint helps users configure providers that switch headers during rotation.

Was this helpful? React with 👍 or 👎 to provide feedback.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mintlify Bot added 2 commits

October 22, 2026 09:12


          docs(webhooks): trim to additionalSignatureHeaders, rotation docs lan…

dbc030c

…ded on main


          docs(webhooks): drop rotation docs covered on main, keep additionalSi…

d574cf3

…gnatureHeaders

mintlify Bot changed the title ~~docs(webhooks): document signing secret rotation grace period~~ docs(webhooks): document additionalSignatureHeaders for custom HMAC sources

Oct 22, 2026

devin-ai-integration Bot reviewed

Oct 22, 2026

View reviewed changes

devin-ai-integration Bot left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 2 new potential issues.

⚠️ 1 issue in files not directly in the diff

⚠️ Generated clients lose rotation grace period

When clients use this schema, previousSecretTtlSeconds disappears from both secret-rotation requests. The rotate-secret handler still accepts it, so generated clients cannot request the supported grace period.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

docs/webhooks/sources.mdx

		});
		```

		To accept a signature from more than one header, list the extra headers in `additionalSignatureHeaders` (up to 4). Trigger.dev parses each one like `signatureHeader` and accepts a match in any of them. Use this when a provider sends a second signature, for example one signed with the previous secret during a rotation. `signatureHeader` is still required. The built-in [`hookdeck()`](#hookdeck) source already checks `X-Hookdeck-Signature-2` this way.

devin-ai-integration Bot Oct 22, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Hookdeck example points to nonexistent source

The #hookdeck anchor has no matching section, and webhookSources exposes no hookdeck() preset. Readers cannot follow this example or configure the claimed built-in source.

Was this helpful? React with 👍 or 👎 to provide feedback.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

pkg-pr-new Bot commented Oct 22, 2026

Copy link

Copy Markdown

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/build@d574cf3

trigger.dev

npm i https://pkg.pr.new/triggerdotdev/trigger.dev@d574cf3

@trigger.dev/core

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/core@d574cf3

@trigger.dev/linear

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/linear@d574cf3

@trigger.dev/python

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/python@d574cf3

@trigger.dev/react-hooks

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/react-hooks@d574cf3

@trigger.dev/redis-worker

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/redis-worker@d574cf3

@trigger.dev/rsc

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/rsc@d574cf3

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/schema-to-json@d574cf3

@trigger.dev/slack

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/slack@d574cf3

@trigger.dev/sdk

npm i https://pkg.pr.new/triggerdotdev/trigger.dev/@trigger.dev/sdk@d574cf3

commit: d574cf3

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This branch has not been deployed

No deployments

Reviewers

devin-ai-integration[bot]

devin-ai-integration[bot] left review comments

ericallam

ericallam approved these changes

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

ericallam

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

mintlify Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

changeset-bot Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

devin-ai-integration Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

⚠️ Generated clients lose rotation grace period

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented Oct 22, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mintlify Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

changeset-bot Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

devin-ai-integration Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.