Your receiver must verify a webhook before it writes to your CMS. A secret-looking URL alone is not sender verification.
Use server-side credentials
Connect a Webhook in Spron and save the access token shown once. Use it as the receiver's Bearer token and signing secret. Keep it on the server, never in public browser code.
Verify the original message
Spron sends Authorization: Bearer followed by the connection token.
It also sends Webhook-Id, Webhook-Timestamp and Webhook-Signature. Verify the signature over the exact raw body, check timestamp freshness, and reject mismatched IDs, and recognise completed deliveries without writing twice.
Do not parse and re-serialize the JSON before verifying it. Changing whitespace or key order changes the signed bytes.
Signing reference
Webhook-Signature has the form v1,<base64 HMAC>. Its input is:
Webhook-Id.Webhook-Timestamp.rawBody
Use HMAC-SHA256 with the connection secret. The legacy X-Spron-Signature header is sha256=<hex HMAC> over the raw body. Do not silently fall back to legacy verification when standard signature headers are present but invalid.
The Idempotency-Key header is the delivery_id. Store the completed delivery result so a retry can return the same response without writing twice.
Keep writes safe across workers
Use a unique article.id reference and an atomic create-or-update operation in your content store. Protect writes across processes and stop older revisions from overwriting newer ones.
An in-memory list of seen deliveries is not enough when requests can reach different server instances.
Test before enabling delivery
Check valid delivery, wrong token, wrong signature, old timestamp, repeated delivery and two simultaneous requests. None of the rejected or repeated requests should create another post.
For a Node.js receiver, review the Spron receiver package and the integration example shown in the app. Adapt its storage callbacks to your own content store.
Zapier Catch Hook parses the message but does not verify Spron's signature for you. If sender verification is required, put a verified receiver before your automation workflow.