Security

Security

Webhook endpoints receive system-changing events, so your endpoint should verify that each request is from Jodo before processing it.

Jodo supports multiple validation approaches. You can use one or combine them depending on your security requirements.

Custom Header

Your ERP system can share a custom header name and value with Jodo. Jodo sends that header with webhook requests for the configured event subscription.

Your endpoint should reject requests where the header is missing or does not match the expected value.

IP Address Allowlisting

You can restrict webhook traffic to known Jodo source IPs.

UAT

• 3.108.86.33
• 13.127.40.177
• 65.0.77.215

Production

• 3.6.234.242
• 3.111.80.40
• 13.232.24.175
• 43.204.202.190

Signature Verification

For stronger request validation, configure a shared secret. Jodo can use the secret to send a signature in the X-Jodo-Signature request header.

To verify the request:

1. Read the raw request body.
2. Generate an HMAC SHA-256 signature using the shared secret and raw body.
3. Compare your generated signature with X-Jodo-Signature.
4. Process the request only when the signatures match.

import hashlib
import hmac

secret_key = b"my-secret-key"
payload = request.data
received_signature = request.headers.get("X-Jodo-Signature")

expected_signature = hmac.new(
    secret_key,
    payload,
    hashlib.sha256,
).hexdigest()

if hmac.compare_digest(expected_signature, received_signature or ""):
    print("Request from Jodo")
else:
    print("Invalid webhook signature")

Use constant-time comparison, such as hmac.compare_digest, to avoid timing-based comparison leaks.

Recommended Setup

For production integrations, use signature verification and IP allowlisting together where possible. Custom headers are useful as an additional guard, but should not be the only validation mechanism for sensitive workflows.