Source type

GitHub Source Configuration

GitHub sources receive repository, organization, GitHub App, issue, pull request, workflow, deployment, and push events with raw-body signature verification.

Direct answer

GitHub identifies the event with x-github-event, the delivery with x-github-delivery, and signs the raw request body in x-hub-signature-256 using HMAC-SHA256.

GITHUBPOST, PUT, PATCH, DELETEWebhook Signing SecretDeveloper tools
GitHub webhooks documentationGitHub webhook gatewayAll source types
GitHub sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.GitHubProviderPOST, PUT, PATCH, DELETESignedFastHookSource URLGITHUBProvider credentialsignatureVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.

GitHub configuration

Create a GitHub source, keep POST and PUT and PATCH and DELETE enabled, and provide the configured Webhook Signing Secret values for provider signature. FastHook uses these settings to validate each GitHub delivery before it enters the routing workflow.

Source Type

GITHUB

Allowed methods

POST, PUT, PATCH, DELETE

Authentication

Provider signature

Credential fields

Webhook Signing Secret

GitHub source config
{
  "type": "GITHUB",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "GITHUB",
      "webhook_signing_secret": "provider-secret"
    },
    "allowed_http_methods": ["POST","PUT","PATCH","DELETE"]
  }
}

GitHub request contract

FastHook computes HMAC-SHA256 over the exact raw request body and compares it to x-hub-signature-256 with the sha256= prefix.

POSTPUTPATCHDELETE

GitHub headers

Preserve x-hub-signature-256, x-github-event, x-github-delivery when sending GitHub test deliveries. FastHook evaluates this request context before accepting the payload, so missing or modified values remain visible as rejected requests instead of routed events.

x-hub-signature-256

HMAC-SHA256 signature with the sha256= prefix.

x-github-event

GitHub event family, useful for routing and filters.

x-github-delivery

Provider delivery id, useful for debugging and idempotency.

GitHub setup

  1. Create a GitHub repository, organization, or GitHub App webhook.
  2. Paste the generated FastHook Source URL into GitHub's Payload URL field.
  3. Use the same secret in GitHub and in the FastHook Webhook Signing Secret field.

GitHub routing hints

  • Push, pull_request, workflow_run, release, deployment, issue, and organization events usually route by x-github-event plus payload fields.
  • Use x-github-delivery as a delivery id when receivers need idempotency or support investigation.

Continue with GitHub