Every deployed Microfn function can receive HTTP requests at its run URL. That makes a function useful as a webhook endpoint, but the endpoint must validate the sender before acting on the payload.
Handle the payload
Create a function such as order-webhook:
type OrderEvent = {
type?: string;
order?: { id?: string; total?: number };
};
export async function main(input: OrderEvent) {
if (input.type !== "order.created" || !input.order?.id) {
throw new Error("Unsupported webhook payload");
}
console.log(`Received order ${input.order.id}`);
return { accepted: true, orderId: input.order.id };
}
Save it, open Triggers, and copy the run URL. Configure that URL in the service that sends the webhook.
Authenticate the sender
Use the strongest mechanism the sender supports. A shared token in the JSON body is simple but should only be used when the provider cannot sign requests. Store the expected value as a Microfn secret, compare it before doing work, and never print it.
Signature schemes often require the exact raw request body plus request headers. Confirm that the fields required by the provider are present in the Microfn input before implementing its signature algorithm. Do not claim signature verification if the trigger does not expose those exact bytes and headers.
Test and replay
Send a test event from the provider, open Executions, and inspect the received input. Use Replay after changing the handler so you can test the same captured event again. The GitHub to Discord guide shows a complete downstream notification workflow.