Verify Webhooks coming from Jira.

[Patrick Alcomendas]

Hello, 

We are building a Webhook in Jira that sends data to a Google Cloud Function. However, GCF will only accept OAuth2.0 as the authentication and Jira doesn't have the ability to generate/refresh the token so using a Bearer Token is not an option and we are forced to have the GCF to allow un-authenticated request which is not a good idea.
Other system like Hubspot (https://developers.hubspot.com/docs/api/webhooks/validating-requests) and Shopify (https://shopify.dev/tutorials/manage-webhooks#verify-webhook) has this feature where the webhook request includes a digital signature which is generated by signing the body using a client secret and can be validate in GCF. This will ensure that the request is legit. Now, I've been looking for documents, but, couldn't find if Atlassian/Jira has this same feature.

Thanks in Advance.

Patrick

[Dario B]

Hello @Patrick Alcomendas ,

Welcome to the Atlassian Community!

Webhooks authentication is only supported when building apps/add-ons, for details see: 

• https://developer.atlassian.com/cloud/jira/platform/modules/webhook/

For the rest, when configuring a webhook via the Jira UI, the headers aren't actually configurable and therefore the requests cannot be sent with an authentication header. For your reference, we have this (rather old) suggestion ticket:

•  [JRACLOUD-31953] Not being able to create webhooks with basic authentication.

As a possible workaround, I'd suggest to create an Automation Rule (global or project specific) and use the Send outgoing web request automation action to send your webhooks when the desired conditions are matched, since this way you can configure the request headers.  

For more details please see: 

• Automate your Jira Cloud processes and workflows
• Create and edit rules 
• Send outgoing web request 
• Automation for Jira - Send web request using Jira REST API

I hope this helps.

Cheers,
Dario