Hi everyone,I'm working with Confluence Cloud and using Automation to send outgoing webhooks to my server whenever a page event occurs.My problem:I want to verify that the webhook payload received on my server actually came from Confluence and hasn't been tampered with — similar to how Jira Cloud webhooks work, where Jira signs the payload using HMAC-SHA256 and sends it in the X-Hub-Signature header, generating a unique signature per request based on the payload content.What I've found so far:Confluence Data Center supports HMAC signing natively when you define a secret on the webhookConfluence Cloud Automation does NOT seem to have this — there's no secret/signing option when sending a web request via AutomationI tried using a smart value like {{webhookData.toJsonString.hmacSha256("my-secret")}} in a custom header but hmacSha256 doesn't appear to be a supported smart value functionWhat I'm NOT looking for:A static token in the header like X-Signature: my-secret-token — this is the same value every time and doesn't prove the payload hasn't been tampered with. It only checks the source, not the integrity of each individual request.What I AM looking for:A way to dynamically sign each webhook payload from Confluence Cloud Automation, where the signature changes per request based on the payload content — exactly like Jira's HMAC-SHA256 implementation. Either:A smart value function that can generate a dynamic HMAC signature (e.g. hmacSha256("secret"))A built-in secret/signing option in the Send Web Request action that I may have missedOr any workaround others are using to achieve proper payload integrity verificationAny help appreciated. Thanks!
Hi everyone,
I'm working with Confluence Cloud and using Automation to send outgoing webhooks to my server whenever a page event occurs.
My problem:I want to verify that the webhook payload received on my server actually came from Confluence and hasn't been tampered with — similar to how Jira Cloud webhooks work, where Jira signs the payload using HMAC-SHA256 and sends it in the X-Hub-Signature header, generating a unique signature per request based on the payload content.
X-Hub-Signature
What I've found so far:
{{webhookData.toJsonString.hmacSha256("my-secret")}}
hmacSha256
What I'm NOT looking for:A static token in the header like X-Signature: my-secret-token — this is the same value every time and doesn't prove the payload hasn't been tampered with. It only checks the source, not the integrity of each individual request.
X-Signature: my-secret-token
What I AM looking for:A way to dynamically sign each webhook payload from Confluence Cloud Automation, where the signature changes per request based on the payload content — exactly like Jira's HMAC-SHA256 implementation. Either:
hmacSha256("secret")
Any help appreciated. Thanks!
Hi @Vatsal Patel
I think this is what you're looking for: AUTO-4: More authentication options for outgoing webhook "Send web request" component and "Incoming webhook" trigger- e.g. to support GraphQL Actions, NTLM auth, OAuth for use with Google APIs, MATLS support, HMAC Support 👀
Maybe you could somehow leverage Confluence API (pull model) or create some kind of middleware that would receive requests from Confluence 🤔 But that does sound like a lot of effort to actually build something like that.
You could also check and ask this in Developer community > potentially someone out there can suggest better alternatives or workarounds for this.
Cheers,Tobi
It looks like you're new here. Sign in or register to get started.
