Outbound webhooks

An owner or admin can manage outbound endpoints in Settings > API and MCP. Each endpoint receives an HMAC-SHA256 signature in X-Setterflo-Signature and a millisecond timestamp in X-Setterflo-Timestamp. Verify the signature against timestamp.body with the secret shown once at creation, and reject timestamps outside five minutes.

On the isolated preview, delivery is limited to the internal metrics receipt and remains a dry run. No external webhook destination or live message send is active.