TenantPoint Zapier Webhook Security
How TenantPoint verifies Zapier REST-hook events and keeps that process separate from customer-managed webhooks.
#Zapier event verification
TenantPoint's Zapier REST-hook events are signed with ES256 using an approved P-256 public JWK. The TenantPoint Zapier integration verifies the exact raw event body and its event, subscription, timestamp, environment, and signing-key identifiers before accepting a trigger. The verification window is limited to five minutes to reduce replay risk.
Do not modify webhook URLs, replace signature verification with a URL-only or HMAC check, or log event secrets. Keep credentials in Zapier's protected connection storage and rotate a connection key through TenantPoint if it may have been exposed.
#Customer-managed webhooks are different
TenantPoint customer-managed HTTPS webhook endpoints use their own one-time HMAC-SHA256 signing secret. That guidance is not a substitute for the Zapier integration's ES256 public-key verification.
Each subscription belongs to the API key that created it. Removing a Zap uses the saved subscription identity and the same connection; repeated removal is safe. For an unexpected trigger, record the event ID, subscription ID, time, environment, and request ID without credentials or private payloads before contacting support.