Class HookdeckSource

A Hookdeck source and its inbound verification, as one unit.

Hookdeck models these separately, but a source without its SourceAuth is a publicly writable endpoint, so the two are only ever correct together. Pairing them means the credential and the thing it protects can't drift apart, and the 14-of-40 sources that had auth in Terraform stop being distinguishable from the ones that merely forgot.

const publish = new HookdeckSource("cfx-publish", {
  name: "cfx-publish",
  auth: {
    type: "HMAC",
    config: {
      algorithm: "sha256",
      encoding: "base64",
      header_key: "x-cfx-signature",
      webhook_secret_key: publishSecret,
    },
  },
  provider,
});
Copy

url is the value to hand upstream. It is assigned by Hookdeck at creation and is stable for the life of the source — which is why sources are imported rather than recreated.