Best Practices

Never commit tokens

Keep whk_… tokens and Firebase keys out of .tf files and version control. Use the environment variables instead:

export WEBHOOKR_API_TOKEN="whk_xxxxxxxxxxxxxxxxxxxxxxxx"

If a token ever lands in a commit, revoke it immediately and issue a new one.

Use environment variables for secrets

Prefer WEBHOOKR_API_TOKEN (and the WEBHOOKR_FIREBASE_* variables) over inline provider arguments. This keeps secrets out of both your configuration and Terraform state, and lets CI inject them from a secret store.

Protect Terraform state

Terraform state can contain sensitive values. Use a remote backend with encryption and access control (for example an encrypted object store), and restrict who can read it.

Rotate tokens

Rotate API tokens on a regular schedule and whenever someone with access leaves:

1. Create a new token in Settings → API tokens.
2. Update the secret in your CI/secret store.
3. Revoke the old token.

Using a separate token per pipeline makes rotation and revocation low-risk — you only affect one consumer at a time.

Least privilege

Scope automation to only what it needs:

• One token per pipeline or environment, named so its use is obvious.
• Separate projects for separate environments (e.g. payments-prod and payments-staging) so a token's blast radius is contained.

See Token permissions for the current scope model.

Plan before apply

Always review terraform plan before terraform apply. Changing a destination's url, method, or headers affects where live webhooks are delivered — treat it like a production change.

Keep ingest URLs in outputs

Endpoint slugs are generated by Webhookr, so derive ingest URLs from resource outputs rather than hardcoding them. See the complete example.