Skip to main content
A public URL is only as safe as who’s allowed to call it. getrequest gives every endpoint two, completely independent authentication slots so you control both directions of that call:
  • Authentication — verifies the caller hitting your getrequest endpoint URL, before getrequest does anything else with the request.
  • Destination Authentication — attaches a credential to the outbound call getrequest makes to your destination (Sync API and Async API only — Static API has no destination to call).
Read this before configuring either one. Configured credentials are currently stored and displayed in plaintext — they appear unredacted in the endpoint settings shown on every captured log entry for that endpoint, exactly like any other configuration value. Unlike request/response headers (where sensitive header values are masked), auth secrets are not currently masked in the log detail view. Anyone on your team who can view a project’s Logs in the dashboard can see them. (Shared, public log links do not expose this — that read-only view never includes endpoint settings, only the request/response itself.) Until this changes, treat getrequest endpoint auth secrets as visible to your whole team, and avoid reusing a production-critical secret here that you wouldn’t want appearing in a teammate’s screenshot.

​
Authentication (verifying the caller)

Set this to require a credential on every request before getrequest will process it — useful when your endpoint URL might leak (a Slack message, a shared log link, a support ticket) and you don’t want it usable by anyone who finds it. Options, selected from a Type dropdown when editing the endpoint: A request that fails this check gets 401 Unauthorized and never reaches your destination — but it is still logged (tagged so you can tell a real auth failure apart from a misconfigured client), so you can audit who’s probing your endpoint.
HMAC here is the same mechanism most webhook providers (Stripe, GitHub) use to sign their payloads to you. If you’re capturing a provider’s webhook and want getrequest to reject anything not actually from that provider, set Authentication to HMAC with the provider’s signing secret and the header they document (e.g. Stripe-Signature, X-Hub-Signature-256).

​
Destination Authentication (authenticating to your backend)

Set this when your destination itself requires a credential — an internal API that expects a bearer token, a partner API behind Basic Auth, or a receiver that verifies an HMAC signature on the way in. Same four types, applied to the outbound call instead: Whichever type you configure, getrequest strips any Authorization header the original caller sent before attaching yours — the configured destination credential always wins and is never overridable by the caller. Destination Authentication applies identically whether the endpoint is Sync API or Async API, including every automatic retry attempt — see Sync vs. Async endpoints. If you rotate a destination credential, the next retry attempt (or the next live request) picks up the new value; nothing is cached from an earlier attempt. Set up right, the two slots work together: Authentication decides who’s allowed to hand you a request at all, Destination Authentication proves to your own backend that the request genuinely came through getrequest — and neither one requires a line of code on your side.