Handling incoming webhooks

Patterns 6 · 3:58

Act only on the payment notifications a bank signs. The bean signatureCheck in the integration's route fails the exchange unless the bank's signature header matches the body's signature recomputed with the project secret.

Download the mp4Recorded on 2026.2.2

What it covers

The webhook version that receives calls at the gateway and stores each on its channel
Each stored call listed with weikio events list
The kamelet weikio-event-source, which starts the integration's route by reading the channel
The bean signatureCheck and the project secret, whose value Weik.io keeps outside the integration's folder
The published version of the integration, which weikio deploy puts in production
A failed exchange, which is retried and kept as a dead letter you resend or discard

Commands in this video

Terminal

$ weikio deploy finance/bank-notification-handler --env production --version 0.1.0 -y
$ weikio logs finance/bank-notification-handler --env production --since 1m
$ weikio events list finance/bank-notification-received --env production --family hook --api bank-notifications --since 1h

Transcript

0:01A bank sends payment notifications as HTTP calls,
0:05but you act only on the ones it signs.
0:12The bank posts notifications to the gateway in production.
0:19The bank's key lets any call in, so this one would book 5000.00 EUR nobody owed.
0:29Weik.io has the webhook version and its channel,
0:32the kamelet weikio-event-source and the project secret.
0:41The webhook version bank-notifications v1 receives calls at the gateway.
0:47The gateway stores each call on the channel that version names,
0:50with the caller's headers.
0:52Weik.io answers only after storing the call's body.
0:56The Weik.io CLI lists each stored call with weikio events list.
1:05The kamelet weikio-event-source starts the route by reading the channel.
1:10Each stored call arrives as one message, the body as the bank sent it.
1:15The bank's signature arrives as the header Weikio-Hook-X-Signature.
1:21You see the header on the admin UI's Events page.
1:29The project secret bank-webhook-secret has a value per environment.
1:34The bean signatureCheck, the route's first step,
1:38recomputes the body's signature with the secret and fails
1:41the exchange unless Weikio-Hook-X-Signature matches it.
1:46Weik.io keeps the value outside the integration's folder.
1:49The secret is in Variables and secrets.
1:56weikio deploy puts the published version of the integration in production.
2:08The webhook version stores and answers the call.
2:14The kamelet hands it over, then the bean's check passes.
2:18weikio logs shows the call accepted and the payment booked.
2:30The webhook version stores the second notification and answers it too.
2:37The bean finds the signature doesn't match, so the exchange fails.
2:49A failed exchange is retried,
2:51kept as a dead letter with its reason on the Dead letters page,
2:55where you resend or discard it.
3:01The CLI lists every call the webhook version stored, the refused one too.
3:14The receipt on the Events page keeps the bank's
3:17signature header under the name Weikio-Hook-X-Signature.
3:27The project secret is set for production, and its value is shown nowhere.
3:36The webhook version and its channel store every call the bank sends.
3:41The kamelet weikio-event-source hands each stored call to the route.
3:46The bean signatureCheck checks the signature against the project secret.