5dd914b8a6
All checks were successful
check / gate (push) Successful in 18s
Eternitas verifies a webhook URL answers BEFORE issuing the secret that signs deliveries, so the very first request can never carry a signature — refusing it makes registration impossible. Real chicken-and-egg, not a reason to disable validation. A probe is a request claiming no event and carrying no signature. Answering it 200 is honest: the endpoint exists and is ready. It changes nothing (acted: false), and anything claiming to BE an event still goes through full HMAC verification. Registering with skip_validation:true would have permanently disabled a safety check to solve a one-time ordering problem. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>