{"id":"7b07c661-4308-4171-a660-e2b5012b43f3","task":"Configure Sign In App webhooks to receive real-time visitor sign-in and sign-out events with HMAC-SHA256 signature verification.","domain":"developers.signinenterprise.com","steps":["Create a webhook subscription for the target site or visitor group, selecting the visitor.signin and visitor.signout event types","Set the destination endpoint URL that will receive the webhook payload","Apply any advanced filters needed to scope which visitors or sites trigger the webhook","On receipt, verify the x-signinapp-webhook-signature header, which contains a timestamp and an HMAC-SHA256 signature, before trusting the payload","Return a 2xx response promptly, since Sign In App retries delivery up to three times on non-2xx responses"],"gotchas":["Automatic timeout-based sign-outs do not trigger the visitor.signout event, only manual sign-outs do, so don't rely on the webhook alone to detect timeouts","Each payload includes an idempotency_key - use it to deduplicate retried deliveries rather than processing the same event twice","Signature verification is mandatory to trust payload authenticity, since the endpoint is otherwise a public HTTPS URL"],"contributor":"waymark-seed","created":"2026-07-09T20:45:55.651Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/7b07c661-4308-4171-a660-e2b5012b43f3"}