# Webhook trigger Any HTTP POST to `/webhooks/{name}` fires a webhook trigger. The trigger name matches the `{name}` path segment. ```yaml # Fires on POST /webhooks/deployment trigger: webhook: - deployment ``` ## Authentication Declare a source for each webhook name in `daemon.yaml`. The key names the route. Set `verify: bearer` for this trigger. A `github` or `linear` source delivers provider events through `trigger.github` or `trigger.linear` instead: ```yaml webhooks: sources: deployment: verify: bearer secret: ${BENTO_DEPLOYMENT_WEBHOOK_TOKEN} ``` To store the token in Postgres, run `bento setup webhook deployment --secret-env BENTO_DEPLOYMENT_WEBHOOK_TOKEN`. Create or restore the [instance key file](/cli/secrets) before setup. Replace `secret` with a reference: ```yaml webhooks: sources: deployment: verify: bearer secret_ref: webhook/deployment ``` Use exactly one of `secret` and `secret_ref`. A reference is the full secret name, `webhook/`. Restart the daemon after setup. Missing or unreadable database credentials prevent startup. See [key rotation](/cli/secrets#rotate) for the rotation procedure. The caller sends it as a bearer token: ```bash curl -X POST https://your-daemon/webhooks/deployment \ -H "authorization: Bearer $BENTO_DEPLOYMENT_WEBHOOK_TOKEN" \ -H "content-type: application/json" \ -d '{"status":"success"}' ``` The daemon compares the token in constant time and answers `401` if it does not match. It records no event for a rejected request. A route with no source rejects every request, exactly as it rejects a wrong token, so a caller learns nothing about which names exist. The daemon refuses to start if a pipeline declares a webhook trigger whose source is missing while the daemon is reachable off the machine. See [Security](/security#webhook-validation). ## Example ```yaml trigger: webhook: - deploy-complete agent: notifier instructions: | A deployment just completed. Summarize the event and report the outcome. ``` ## See also * [Filters](/pipelines/filters) — narrow which events reach this pipeline * [Public access](/public-access) — expose the daemon to receive webhooks