Other senders
Not every sender signs its requests. These methods cover the rest.
| Method | The request must carry | The source’s secret |
|---|---|---|
basic |
Authorization: Basic … |
user:password |
api_key |
The key in the header named by header, or the query parameter named by query |
The key |
shared_secret |
The token in a body field, named by field (a dotted path in JSON, or a form field) |
The token |
none |
Nothing: every request is stored as not verified |
With any method, including none, allowed_ips limits requests to a list of IPv4 or
IPv6 CIDR ranges, for senders that publish their addresses:
{ "method": "api_key", "header": "x-api-key", "allowed_ips": ["203.0.113.0/24"] }Endpoint handshakes
Section titled “Endpoint handshakes”Some providers check an endpoint before they send to it. Set the source’s handshake and Ricochet answers the check itself, before verification, without storing it:
| Handshake | The check |
|---|---|
slack |
A POST with "type": "url_verification"; answers its challenge. |
meta |
A GET with hub.mode=subscribe (Facebook, Instagram, WhatsApp); answers hub.challenge. |
microsoft_graph |
A request with a validationToken query parameter; answers it. |
dropbox |
A GET with a challenge query parameter; answers it. |
The handshake is answered before the method check, so a source that only accepts
POST still answers a GET challenge.