langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-23 12:55:40 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #4238] [MERGED] Document Engine webhook signing secrets [LSEN-174] #4225

New Issue
Closed
opened 2026-06-05 19:13:11 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 19:13:11 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/4238
Author: @vishnu-ssuresh
Created: 6/1/2026
Status: ✅ Merged
Merged: 6/2/2026
Merged by: @vishnu-ssuresh

Base: main ← Head: vishnu/issue-webhook-signing-docs

📝 Commits (5)

  • 67d5a1f Document Engine webhook signing secrets
  • c9a6cda Merge remote-tracking branch 'origin/main' into vishnu/issue-webhook-signing-docs
  • 3363fc4 Document Engine run failure webhook event
  • cfc2545 Simplify Engine webhook name field docs
  • db1e8a5 Merge branch 'main' into vishnu/issue-webhook-signing-docs

📊 Changes

1 file changed (+134 additions, -8 deletions)

View changed files

📝 src/langsmith/engine-webhooks.mdx (+134 -8)

📄 Description

What

Updates the Engine webhook events docs to describe webhook signing secrets, X-LangSmith-Signature, and signing-secret rotation.

Why

Users need to know how to verify that Engine webhook deliveries came from LangSmith and how to rotate the secret when it is exposed or due for credential rotation.

How

  • Adds the signature header to the delivery contract.
  • Documents the sha256=<hex HMAC-SHA256 digest> format.
  • Adds Python and TypeScript verification examples using the raw request body.
  • Replaces the old security note that said Engine webhooks were unsigned.
  • Adds instructions for rolling a signing secret from Engine Settings.

Testing

  • Tested the Python verification example locally with a valid and invalid signature.
  • Tested the TypeScript verification logic locally with Node using a valid and invalid signature.
  • git diff --check

Not completed locally: make check-cross-refs failed during dependency setup because quickjs-rs attempted to bootstrap Rust under ~/Library/Caches/puccinialin and hit a permissions error before running the check.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/4238 **Author:** [@vishnu-ssuresh](https://github.com/vishnu-ssuresh) **Created:** 6/1/2026 **Status:** ✅ Merged **Merged:** 6/2/2026 **Merged by:** [@vishnu-ssuresh](https://github.com/vishnu-ssuresh) **Base:** `main` ← **Head:** `vishnu/issue-webhook-signing-docs` --- ### 📝 Commits (5) - [`67d5a1f`](https://github.com/langchain-ai/docs/commit/67d5a1f0ba4fe0d71f96f056eccb41c8a181663d) Document Engine webhook signing secrets - [`c9a6cda`](https://github.com/langchain-ai/docs/commit/c9a6cda2c55d8df64b0dc050cf59e2e1685effe2) Merge remote-tracking branch 'origin/main' into vishnu/issue-webhook-signing-docs - [`3363fc4`](https://github.com/langchain-ai/docs/commit/3363fc4b5307fb1d376eca0997f774b54a77309f) Document Engine run failure webhook event - [`cfc2545`](https://github.com/langchain-ai/docs/commit/cfc25459bbb710537830b2592ea77df43a3c0735) Simplify Engine webhook name field docs - [`db1e8a5`](https://github.com/langchain-ai/docs/commit/db1e8a52c2c93765069a6ce39a37d844a945fa4d) Merge branch 'main' into vishnu/issue-webhook-signing-docs ### 📊 Changes **1 file changed** (+134 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `src/langsmith/engine-webhooks.mdx` (+134 -8) </details> ### 📄 Description ## What Updates the Engine webhook events docs to describe webhook signing secrets, `X-LangSmith-Signature`, and signing-secret rotation. ## Why Users need to know how to verify that Engine webhook deliveries came from LangSmith and how to rotate the secret when it is exposed or due for credential rotation. ## How - Adds the signature header to the delivery contract. - Documents the `sha256=<hex HMAC-SHA256 digest>` format. - Adds Python and TypeScript verification examples using the raw request body. - Replaces the old security note that said Engine webhooks were unsigned. - Adds instructions for rolling a signing secret from Engine Settings. ## Testing - Tested the Python verification example locally with a valid and invalid signature. - Tested the TypeScript verification logic locally with Node using a valid and invalid signature. - `git diff --check` Not completed locally: `make check-cross-refs` failed during dependency setup because `quickjs-rs` attempted to bootstrap Rust under `~/Library/Caches/puccinialin` and hit a permissions error before running the check. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 19:13:11 -04:00
yindo closed this issue 2026-06-05 19:13:11 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#4225
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?