Notion API ➔ Tally Webhook Pipeline Specification Webhook Specification, Headers & Security

Technical Integration Summary

Technical guide for receiving and processing automated Notion API ➔ Tally Webhook Pipeline Specification event notifications. Follow these security guidelines to prevent unauthorized webhook calls.

Supported Events: contact.creation deal.stage_change company.updated ticket.created

Authentication & Request Headers

Security validation specs for Notion API ➔ Tally Webhook Pipeline Specification endpoints:

X-NotionAPI➔TallyWebhookPipelineSpecification-Signature: t=1789764056,v1=c6754164c07f667401ad67e3

Signature Verification Implementations

Node.js (Express)

const crypto = require('crypto');
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const isValid = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

Python (Flask / FastAPI)

import hmac, hashlib
expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
is_valid = hmac.compare_digest(expected, incoming_sig)

Sample Event Payload (contact.creation)

{
  "id": "evt_notion-to-tally.html_62545",
  "event": "contact.creation",
  "created_at": 1789764056,
  "data": {
    "resource_id": "res_206",
    "status": "active"
  }
}

cURL Request Simulation

curl -X POST https://your-domain.com/webhook/notion-to-tally.html \
  -H "Content-Type: application/json" \
  -H "X-NotionAPI➔TallyWebhookPipelineSpecification-Signature: t=1789764056,v1=c6754164c07f667401ad67e3" \
  -d '{"id": "evt_notion-to-tally.html_62545", "event": "contact.creation", "created_at": 1789764056, "data": {"resource_id": "res_206", "status": "active"}}'

HTTP Response Rules

Status Code	Status Meaning	Integration Action
`200 OK`	Success	Event payload validated and queued.
`400 Bad Request`	Malformed Payload	Check payload structure and JSON formatting.
`401 Unauthorized`	Signature Mismatch	Verify secret key and digest computation.
`500 Error`	Server Error	Triggers provider automated retry backoff.

Security Best Practices for Notion API ➔ Tally Webhook Pipeline Specification

Always process incoming events asynchronously using a message queue. Never perform long-running DB queries or external API calls synchronously within the HTTP response handler.

Frequently Asked Questions

Should I restrict incoming IP addresses for Notion API ➔ Tally Webhook Pipeline Specification?

While signature verification is primary, restricting traffic to published origin IP ranges adds a robust layer of perimeter security.

How to handle duplicate Notion API ➔ Tally Webhook Pipeline Specification webhooks?

Store processed event IDs in an atomic storage like Redis with a set expiration. If an incoming ID exists, acknowledge with 200 OK immediately without re-triggering logic.

How does Notion API ➔ Tally Webhook Pipeline Specification handle automatic delivery retries?

Failed deliveries (non-2xx responses) trigger an exponential backoff retry schedule over a period ranging from 24 to 72 hours.