# Webhooks

> Get an HTTP POST when issues, comments, projects and other data change.

Source: https://docs.linefold.app/webhooks

A webhook sends a POST to your URL when issues, comments, projects and other data are created, updated or removed. Create
them in **Settings › API**.

## Verify each request

Every request is signed. Compare the `Linear-Signature` header with the HMAC-SHA256 of the **raw** body under the webhook's
signing secret, and reject old `webhookTimestamp`s:

```ts
import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody: Buffer, signature: string, secret: string) {
  const expected = createHmac('sha256', secret).update(rawBody).digest();
  const received = Buffer.from(signature, 'hex');
  if (received.length !== expected.length || !timingSafeEqual(received, expected)) return false;
  const { webhookTimestamp } = JSON.parse(rawBody.toString());
  return Math.abs(Date.now() - webhookTimestamp) < 60_000;
}
```