Skip to main content
Credentials are available in workflows and in custom code execution. Go to Settings → Developer → Create credential, select HMAC-SHA256, and give it a name. In an HTTP request block, select the saved credential under Authentication. Use HMAC-SHA256 to verify requests at your endpoint. Save the generated secret securely when you create the credential; telli shows it only once. Each request includes an x-telli-signature header containing the HMAC-SHA256 signature of the exact request body, encoded as hexadecimal. To verify it, use the saved secret as the key and the raw body as the message, then compare the hexadecimal result with the header using a constant-time comparison. For requests without a body, use an empty string. In custom code, telli does not sign requests. The code reads the secret from credentials.<name> and computes the signature itself. See Secrets and credentials.