Authorization

Each Alocis account has one webhook token (whtok_ prefix). It is shared across all destinations and is sent in every delivery JSON under the token field.

Where to find the token

In the dashboard under Add-ons → Webhook you can copy the account token.

1. When you create your first destination, the token may be shown for copy.
2. Later, use regenerate if you need to rotate — store it securely (env var, secrets manager), never in public client-side code.

Regenerating the token

A new token invalidates the previous one for all destinations on the account. Update your integration before rotating in production or validations will fail until you paste the new value.

How to verify in practice

Parse the JSON body, read token, and compare to the value from the dashboard. Use an exact match (for example, === in JavaScript).

1. Only process the event when the token matches.
2. If token is missing or wrong, respond with an error (e.g. 401) and do not run sensitive side effects.
3. Do not log the full token in monitoring tools.

function verifyAlocisWebhook(rawBody, expectedToken) {
  let payload;
  try {
    payload = JSON.parse(rawBody);
  } catch {
    return false;
  }
  if (!payload?.token || typeof payload.token !== 'string') return false;
  return payload.token === expectedToken;
}

Delivery history in the dashboard redacts the token in stored bodies — safer for shared log access.