API and webhooks
Secure webhooks and a public API for event-driven integrations.
Receive inbound webhooks with IP allowlists and HMAC verification. Deliver outbound events with signed payloads and automatic retries. Manage everything programmatically through a REST API with API-key authentication.
Security and integration
Webhooks built for production, not prototyping.
Every webhook endpoint includes the security controls production systems need: HMAC signatures, timestamp validation, IP restrictions, and rate limiting. The REST API gives you programmatic control over the entire workspace.
HMAC signature verification
Every outbound webhook includes an HMAC-SHA256 signature computed from the payload and your secret key. The receiving system can verify the signature to confirm the request came from Fastero and was not tampered with in transit.
Timestamp validation
Webhook payloads include a timestamp header. Receivers can reject requests older than a configurable window (default 5 minutes) to prevent replay attacks. Combined with HMAC, this provides strong delivery integrity.
IP allowlists
Restrict inbound webhook triggers to a set of known IP addresses. If a request arrives from an IP not on the allowlist, it is rejected before processing. Useful for locking down integrations to trusted sources.
Rate limiting
Inbound webhooks are rate-limited per endpoint to prevent abuse. Configurable limits protect your workflows from accidental bursts or malicious flooding without dropping legitimate traffic.
Public REST API
Programmatically manage connections, triggers, workflows, and app deployments through a REST API. Authenticate with API keys, automate setup across environments, and integrate Fastero into your existing CI/CD or operational tooling.
Event delivery and retries
Outbound webhooks retry on failure with exponential backoff. Delivery attempts are logged with status codes and response bodies so you can debug integration issues without guessing what happened.
When to use the API and webhooks
Connect Fastero to the systems your team already runs.
Receiving events from external systems
Accept webhooks from Stripe, Salesforce, GitHub, or any system that can POST JSON. IP allowlists and HMAC verification ensure only trusted sources trigger your workflows.
Delivering results to downstream systems
When a workflow completes, send the result as a signed webhook to your own backend, a partner system, or a data warehouse ingestion endpoint. The receiving system verifies the signature and processes the payload.
Automating setup and management
Use the REST API to create connections, configure triggers, and deploy apps programmatically. Useful for teams managing multiple environments or embedding Fastero setup into infrastructure-as-code workflows.
Security-conscious integrations
Teams in regulated industries or with strict security policies can use IP allowlists, HMAC verification, and timestamp validation to meet compliance requirements for webhook-based integrations.
Related capabilities
Webhooks and APIs tie the workspace together.
Inbound webhooks become triggers. Outbound webhooks become workflow actions. The API lets you automate everything in between.
Triggers
Use inbound webhooks as trigger sources alongside cron and data-change detection.
Workflows
Outbound webhooks and API calls as workflow action steps.
NL2SQL
AI-generated queries that can be triggered and delivered via the API.
Hosted apps
Deploy and manage Streamlit apps programmatically through the REST API.
Frequently asked questions
Common questions about API and webhooks.
How does HMAC signature verification work?
Every outbound webhook includes an HMAC-SHA256 signature computed from the payload and your secret key. The receiving system verifies the signature to confirm the request came from Fastero and was not tampered with in transit. Inbound webhooks support the same pattern — you configure the shared secret, and Fastero rejects payloads with invalid signatures.
What happens if an outbound webhook delivery fails?
Failed deliveries are retried with exponential backoff. Each attempt is logged with the HTTP status code and response body so you can diagnose integration issues. After retries are exhausted, the delivery is marked as failed and visible in the execution log.
Can I restrict which IP addresses can send inbound webhooks?
Yes. Each webhook trigger endpoint supports IP allowlists. Requests from IPs not on the allowlist are rejected before processing. This is useful for locking down integrations to trusted sources like Stripe, Salesforce, or your own backend.
What can I do with the REST API?
The public REST API lets you programmatically manage connections, triggers, workflows, and app deployments. Authenticate with API keys, automate workspace setup across environments, and integrate Fastero into existing CI/CD or infrastructure-as-code workflows.
How does timestamp validation prevent replay attacks?
Webhook payloads include a timestamp header. Receiving systems can reject requests older than a configurable window (default 5 minutes). Combined with HMAC signing, this prevents an attacker from capturing and replaying a legitimate webhook payload.
Can I connect Stripe or Shopify webhooks to Fastero?
Yes. Any system that can POST JSON to a URL can trigger a Fastero webhook. Configure your Stripe or Shopify webhook settings to point to your Fastero trigger endpoint, set up HMAC verification with the shared secret, and the trigger fires on every event. From there, workflows can update tracking tables, refresh dashboards, or send alerts.
Production-grade webhooks without building the infrastructure.
HMAC signing, IP allowlists, rate limiting, and retry logic — all included. Connect your systems to Fastero in minutes. Free to start.