[Feature New Product] Webhook Security Headers for Conversation Provider Webhooks

[i-am-rad]

🌟 Describe the Feature

Conversation providers outbound messages do not have webhook security headers.

🚀 Justification

Please add them to secure hooks.

📝 Suggestions

Add security headers

Product Area

conversations

📋 Use Case

Security

🚨 Why Should This Be Prioritized?

Security

🧠 Additional Context

Tested using a custom email provider. Also affects SMS providers. Outbound message webhook event.

[github-actions]

✅ Issue processed successfully!

Your issue has been reviewed and assigned to the appropriate team.

[carlosm2498]

+1 for webhook security headers or signature verification.

[i-am-rad]

Additionally, the payload coming to the conversation provider outbound webhook differs from the OutboundMessage webhook event payload. That event has way more useful information in it like:

{ "type": "OutboundMessage", "locationId": "abc", "versionId": "672a531581f0e73aaafabac4", "appId": "672a531581f0e73aaafabac4", "body": "words", "contactId": "123", "contentType": "text/plain", "conversationId": "09D43K4gFH8ZK0Wd6wGE", "dateAdded": "2026-01-16T02:08:03.586Z", "direction": "outbound", "messageType": "Custom", "messageTypeId": 22, "messageTypeString": "TYPE_CUSTOM_PROVIDER_SMS", "userId": "pu4TX2As3sQsxO6nj1jv", "messageId": "ldaaoFaLeUWVoKymWNTG", "status": "delivered", "source": "api", "conversationProviderId": "681630446243877ebda60373", "timestamp": "2026-01-16T02:09:50.730Z", "webhookId": "07689896-e254-47f7-b41d-237ca535c61d" }

Things like versionId, appId, etc. The standard outbound message hook also has webhook event security on it already. @varungarg-highlevel

[varungarg-highlevel]

Hi @i-am-rad , thanks for raising this and for the additional context.

We have documented the security behavior for Conversation Provider Delivery URL webhooks here:. These deliveries are signed with X-GHL-Signature using Ed25519, and the docs now include the verification flow. The legacy X-WH-Signature header is not sent for Conversation Provider Delivery URL webhooks.