# Webhook Verification - Chicken and Egg?

**URL:** <https://devforum.zoom.us/t/webhook-verification-chicken-and-egg/80507>\
**Category:** API and Webhooks\
**Created:** [December 19, 2022, 6:44pm UTC](https://devforum.zoom.us/t/webhook-verification-chicken-and-egg/80507 "2022-12-19T18:44:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jon.wallace](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.wallace/32/35237_2.png) [@jon.wallace](https://devforum.zoom.us/u/jon.wallace)\
**Post date:** [December 19, 2022, 6:44pm UTC](https://devforum.zoom.us/t/webhook-verification-chicken-and-egg/80507/1 "2022-12-19T18:44:12Z")

</div>

Hello,

Hoping someone can point me in the right direction. In short, with the new webhook verification process do we now have a chicken-and-egg situation?

Let me explain…

When we go in to create a Server to Server Application, upon starting the creation process we are provided with the various credentials, including app secret, id and webhook secret.

Now, in order to configure a webhook, we need to use the webhook secret to perform the validation. So we need to ‘store’ this information, or re-write code to use the webhook secret before we can save the application? I’m hoping this makes sense.

Consider a scenario where users create an app with the intention of using the app to connect to a service. They need to save such credentials in the service but can only get these credentials by starting the create app process…

It seems strange that you can’t complete the app-creation process before saving the credentials in whatever service you are using.

Does this make sense? I might not be explaining it properly…

Cheers,  
Jon

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [December 21, 2022, 10:36pm UTC](https://devforum.zoom.us/t/webhook-verification-chicken-and-egg/80507/2 "2022-12-21T22:36:19Z")

</div>

Great question @jon.wallace

You can save the application that you have created without validating a webhook. However, in order to get the webhook working you’ll want to validate using the secret token.

What I mean here is that you can see the token validation as part of the requisite code for setting up and testing your Webhook. However, it shouldn’t create a circular dependency.

Let me know if that helps to answer your question.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [December 25, 2023, 2:12pm UTC](https://devforum.zoom.us/t/webhook-verification-chicken-and-egg/80507/3 "2023-12-25T14:12:56Z")

</div>

Closed on December 25, 2023, 2:12pm UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.