> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook push

> Configure signed HTTPS notification endpoints with optional headers.

Use webhook push when another service should consume Towbar's operational events. Configure one endpoint per use case. Keep its URL, optional authorization headers, and signing secret in the protected runtime YAML file; the dashboard manages only subscriptions. Webhook push is workspace-wide.

```yaml title="/etc/towbar/towbar.yml" theme={"system"}
notifications:
  enabled: true
  providers:
    webhook:
      - id: operations
        label: Operations
        url: https://hooks.example.com/events
        headers:
          Authorization: "Bearer <receiver-token>"
        signingSecret: "<at-least-32-character-signing-secret>"
  routes: []
```

IDs must be unique and stable because queued deliveries refer to them. Run `sudo towbar config validate` and `sudo towbar restart`, then open **Manage → Notifications → Webhook push**. Towbar displays the label and hostname, not the full URL or secrets. Select **Deployments**, **Backup & Restore**, and **Alerts & Incidents** for each endpoint. New endpoints start with no subscriptions.

## Verify the receiver

Towbar POSTs JSON with `x-towbar-timestamp` and `x-towbar-signature-256: sha256=<hex digest>`. The receiver should calculate HMAC-SHA256 over `<timestamp>.<exact raw request body>` using its signing secret, compare the digest in constant time, and reject stale timestamps. Verify before parsing or acting on the event. Use **Test** in Towbar and inspect the receiving service and [delivery history](/docs/integrations/notifications#delivery-history).

Towbar rejects credentials embedded in URLs, custom ports, private-network destinations, redirects, and reserved delivery-header overrides. If an endpoint fails, check HTTPS reachability, the exact URL path, receiver response, header values, and signature verification. Changing a URL or secret requires YAML validation and restart. Keep the endpoint ID stable when rotating a secret so its subscription remains attached.

<div className="towbar-doc-screenshot">
  <div className="towbar-product-light">
    <img src="https://mintcdn.com/avgeek/ylQA6qTjzIsIRICB/assets/release-v2/webhook-notifications-light.jpg?fit=max&auto=format&n=ylQA6qTjzIsIRICB&q=85&s=7d0f8052b2499c643b38263ee459b4a8" alt="Webhook push endpoints and category subscriptions in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/webhook-notifications-light.jpg" />
  </div>

  <div className="towbar-product-dark">
    <img src="https://mintcdn.com/avgeek/ylQA6qTjzIsIRICB/assets/release-v2/webhook-notifications-dark.jpg?fit=max&auto=format&n=ylQA6qTjzIsIRICB&q=85&s=99f4dd55804d1d67543ea06ad7ab6e0c" alt="Webhook push endpoints and category subscriptions in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/webhook-notifications-dark.jpg" />
  </div>

  <p>
    The endpoint list shows labels and hostnames while keeping full URLs and
    headers in the runtime configuration.
  </p>
</div>