Skip to main content

​
Inbound routes and webhooks

Routes let outside systems call into your app: payment providers, messaging platforms, mobile clients, and similar. Each route points at a tool that handles the request. Protect every route with a secret:
  • A bearer token checked before your handler runs, or
  • A signed webhook when the provider signs its payloads (common for Stripe, GitHub, and similar)
Open endpoints with no secret are not available. Prefer a token or signed webhook. Find routes under App Blueprint → Routes.