Deployka
Sign inStart now
All documentation
Python

Webhook Receiver

A starter FastAPI endpoint for inbound HTTP webhooks. It checks a shared secret in the X-Webhook-Secret header and acknowledges the request, but does not yet process events or verify a specific provider signature.

  1. 1

    Sign up on Deployka

    If you don't have an account yet — create one in 30 seconds: email and password.

    Create an account →
  2. 2

    Get the values you'll need

    This template needs one variable: SECRET_KEY. Here's exactly how to get each one.

    SECRET_KEY
    1. This is the shared secret for the starter endpoint, not an external service token or a provider signature.
    2. The starter expects it in the X-Webhook-Secret header. Use a random string of at least 20 characters.
    3. If a provider only supports its own HMAC signature, add verification for its official signing scheme.

    Do not put this secret in the URL: URLs can be copied to logs and request history.

  3. 3

    Deploy it

    Click the button below — it opens the templates page with this template already selected. If it needs variables, paste the values from the step above and click Deploy.

    Deploy "Webhook Receiver"

    Deploy usually takes 20–40 seconds. The project status appears in your dashboard and switches to "running" once it's ready.

  4. 4

    Check that it works

    After deploying, send a POST request to https://your-project.deployka.dev/webhook with X-Webhook-Secret set to SECRET_KEY. The correct secret returns HTTP 200; a wrong or missing one returns HTTP 401.

    1. Use /webhook as the endpoint path and configure the sender to include X-Webhook-Secret with the SECRET_KEY value.
    2. Test manually first: the correct header should return 200; an incorrect one should return 401.
    3. This starter only acknowledges receipt. Before handling real payments or commands, add provider signature verification, replay protection, and your event-processing logic.

    Some providers cannot send an arbitrary shared header and instead use HMAC signatures. For those providers, replace or extend this check using their official documentation.

  5. 5

    Something not working?

    Open the project page in your dashboard → Logs tab — it shows the exact reason (wrong token, code error, missing variable). Still stuck? Contact support right from your dashboard, or via the Telegram bot with /support.

Looking for another template? See the full list in the docs.