Open source

Webhook authentication for Acumatica

Makes sure only the systems you trust can push data into Acumatica through webhooks, with keys your administrators manage on an ordinary Acumatica screen.

Version 0.2.0MITgithub.com/AISI-Dev-Co/AISI.AcumaticaWebhookAuthenticator

Webhooks let other systems, such as your online shop, payment provider or code repository, send updates straight into Acumatica. Out of the box, Acumatica leaves it to whoever builds the webhook to check that each message really comes from the sender it claims to. When that check is missing or done in a hurry, anyone who finds the address can send data into your ERP.

This add-on closes that gap for the webhooks you put behind it. Each of those messages is checked before your handler acts on it. Messages that fail are turned away. Messages that pass go through as normal.

What you get

  • Only checked senders get in. A message that fails the check you configured is turned away before it reaches your business logic.
  • Ready for the services you already use. Settings come ready-made for GitHub, Shopify, Stripe and a signed bearer token.
  • Keys managed in Acumatica, not in code. Each webhook has its own secret, held on an Acumatica screen. When the site’s encryption certificate is set, that secret is encrypted where it is stored. Administrators can change it without a developer or a redeploy.
  • Key changes without downtime. A changed key takes effect within 30 seconds, with no restart. If you set an overlap, the previous key keeps working until that period ends, so senders can switch without dropping out.
  • Optional limit by address. You can restrict a webhook to known IP addresses.
  • Test before you go live. You can check a real captured request against your settings first.
  • Free and open. MIT-licensed, so you can read and change the source.
View on GitHub

How it works

The add-on sits in front of each webhook you register with it. It reads the incoming message once and checks it against the method you chose for that webhook, such as a signature, a token or a shared secret. If the check fails, the sender gets a plain refusal and your code does not run. If it passes, the message reaches your handler unchanged.

For developers

  • Version: 0.2.0 (4 September 2026), MIT licence. Supports Acumatica 2025 R2 to 2026 R1.
  • Schemes: HMAC from a template with an optional replay window, compact JWT (HS256 and HS512), shared secret, HTTP Basic, or an explicit “none”. A shared secret or HTTP Basic is not tied to the message bytes, so a captured credential can be replayed with a different body. Prefer a body signature when the sender supports it. JWT signs the token, and by default also requires a hash of the body. Your handler extends AuthenticatedWebhookHandlerBase. It reads the body once, within a size limit, returns 401 on failure, and passes the same body on. WebhookSignatureTester checks captured requests.
  • Install:
    1. Download the Core package from the v0.2.0 release, or build it yourself.
    2. Pack the customization zip against a 2025 R2 or later Bin. Do not expect that zip on a GitHub Release built by ubuntu-latest.
    3. Import and publish it on SM204505.
    4. Register your handler and the webhook on SM304000.
    5. Add the secret on AS301000.
  • Limits:
    • Encryption at rest needs the site certificate set on SM200530. Without it, secrets fall back to base64 obfuscation.
    • The IP allowlist is only reliable behind a trusted proxy.
    • It isn’t on nuget.org yet.