THE DOUBLE STANDARD OF WEBHOOK SECURITY AND API SECURITY

Summary from the TLDR Web Dev newsletter

There's a common practice of signing webhook requests with HMAC-SHA256 while API requests often rely on just API keys. Request signing has benefits like reduced secret leakage, replay protection, and integrity verification, but it also introduces complexity and performance overhead. Herd mentality and historical precedent contribute to this double standard, but in today's world, it's fine for webhooks to also just use shared secrets like API requests.