Skip to content

docs(using-webhooks): document app webhook tokens - #193

Merged
josegironn merged 1 commit into
mainfrom
josegironn/app-access-token
Oct 7, 2026
Merged

josegironn merged 1 commit into
mainfrom
josegironn/app-access-token

Conversation

@josegironn

@josegironn josegironn commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Updates the using-webhooks skill for app webhook tokens (mono-builder companion PR adds the feature).

  • Webhook token is the preferred option: sent as x-major-jwt: <token> or ?major_token=<token>, works on the deployed app and the preview.
  • Unauthenticated toggle remains for senders that cannot carry a token; the app must verify provider signatures.
  • Where tokens are created (app Settings > Webhook Tokens). Only app admins create them; the agent never creates or sees a token.
  • App code notes: requests arrive as the token's creator in x-major-user-id; do not log full request URLs because the query can contain major_token.

Merge after the mono-builder PR deploys. After the CLI release, bump the Major CLI in apps/app-sandbox.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W8nD9Q8ch43DP98Qzcq2cZ

Made with Orca 🐋

Add the webhook token as the preferred option (x-major-jwt or
?major_token=), where app admins create tokens, and app-code notes:
requests arrive as the token's creator and full URLs must not be logged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8nD9Q8ch43DP98Qzcq2cZ

Co-authored-by: Orca <help@stably.ai>
@josegironn
josegironn merged commit 632c8b0 into main Oct 7, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant