NextDocs can call your platform, for example to verify an editor's two-step verification code. Each call is signed so you can trust it.
Signature
X-Blog-Timestamp: 1762855200
X-Blog-Signature: hex(hmac_sha256(secret, timestamp + "." + body))
Verifying
- Reject requests whose timestamp is more than a few minutes old.
- Recompute the signature with your webhook secret and compare in constant time.
- Answer quickly; slow answers are treated as failures.
The webhook URL and secret are managed in the tenant console.