# Discourse signing parameters in webhooks

**URL:** <https://meta.discourse.org/t/discourse-signing-parameters-in-webhooks/134415>\
**Category:** Feature\
**Created:** [November 26, 2019, 5:11am UTC](https://meta.discourse.org/t/discourse-signing-parameters-in-webhooks/134415 "2019-11-26T05:11:13Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![EGreg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/egreg/32/133614_2.png) [@EGreg](https://meta.discourse.org/u/EGreg)\
**Post date:** [November 26, 2019, 5:11am UTC](https://meta.discourse.org/t/discourse-signing-parameters-in-webhooks/134415/1 "2019-11-26T05:11:13Z")

</div>

Hey. I would like to use Discourse webhooks for when a user is created or updated, but I would like to be able to trust the data sent over by Discourse. Any way we could have at a public-private key support, or at least a symmetric secret key, that I can use to verify the signed payload? Can we have some standard framework for signing all the payloads and a standard PHP implementation, say, to serialize and verify the signature?

Facebook does it when it sends over the information about a user. This would allow other software to integrate with Discourse users and other objects.

---

_[View the full topic](https://meta.discourse.org/t/discourse-signing-parameters-in-webhooks/134415)._