Hoping someone can tell me what I’m doing wrong here.
I’ve set up a Discourse Webhook and it works as expected without a Secret. I then write a string into the Secret, and then copy that string into the receiving Webhook as a Header, like so:
X-Discourse-Event-Signature: secret_here
This produces the following error in the Body when the sending webhook is sent:
{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}
I expect that I’m just not doing it right, so please enlighten me!
I’m aware that the secret is encrypted using sha256, so the Header that is sent is:
X-Discourse-Event-Signature: sha256=XXX
But I’m not sure what I should be doing with this information in the receiving Webhook Security Headers.