---
updatedAt: 2025-05-07T20:24:31.000Z
agentTools:
  projectIndex: https://docs.onfleet.com/llms.txt
---

# Webhook Validation

## Webhook Validation

All URLs are validated through a simple token exchange mechanism so we may trust that you actually control the target server. Note that validation happens right at webhook creation, meaning that we will issue a request to you before successfully registering the webhook. The validation will send a `GET` request to your `url` with a query string of `check=<random_string>`, your webhook server should respond back with the `<random_string>` to be validated.

For example:

```text Example URL
https://yourwebsite.com/webhooks/?check=example
```

```php php
$reply_value = $_GET['check']; // Outputs example and then send it back
```
```javascript javascript
app.get("/webhooks", (req, res) => {
  res.status(200).send(req.query.check)
})// true, req.query.check send it back
```
```python python
reply = request.GET.get('check')
#send example and reply back with 200
```

In the above example URL, you should return a HTTP 200 (HTTP 204 is not accepted, even though that is considered a successful response) along side with the string `example`. The string will change with each webhook trigger, so it's necessary to have the same string that was returned to our server for validation.

> ❗️ Timed out Timer
>
> The recommended pattern for processing our webhooks is to first respond to our request with an **HTTP 200** response and then process the data afterwards, as the request will time out in 10 seconds without a response. Any timed out requests will be be retried in 30 second intervals. After 300 consecutive failed requests the webhook will be **disabled**.

> 📘 Automatic validation
>
> If you use [Zapier](https://zapier.com/) webhooks instead of your own backend's, validation will be automatic.

> 📘 Serverless
>
> In the case that you do not have a server of your own, i.e. using another 3rd party platform, we recommend using services such as AWS Lambda functions. They can return the validation requirements back to our server, and redirect the payload further downstream to your integration platform.