A Complete Guide to Zendesk Webhooks — Setup, Usage, and Security

When you’re running customer support at scale, one of the most useful tools in Zendesk is the webhook — a way to send real-time data from Zendesk to other systems. But using webhooks securely is just as important as setting them up.

In this article, you’ll learn:

• What a Zendesk webhook is
• How to create and use one
• How to secure it with IP allowlisting and HMAC signature verification
• Example code for handling and validating webhook requests

1. What is a Zendesk Webhook?

A Zendesk webhook is an outbound HTTP request sent from Zendesk to a specific URL you define whenever a certain event occurs — such as:

• A ticket is created or updated
• A user’s profile changes
• A specific automation or trigger fires

Instead of polling Zendesk for changes, webhooks let Zendesk push data to you instantly.

Common use cases

• Send ticket details to Slack or Microsoft Teams
• Push updates into your CRM like Salesforce or HubSpot
• Trigger a server-side process (e.g., logging, analytics, alerts)

Sync ticket data into an external database — important usage!!!!

2. How a Zendesk Webhook Works

1. Create a webhook in Zendesk (pointing to your server endpoint).
2. Link the webhook to a trigger or automation rule.
3. When conditions are met, Zendesk sends an HTTP request to your URL.
4. Your system processes the data and responds with a 2xx status code.

3. Creating a Webhook in Zendesk

Step 1 — Create the webhook

1. Go to Admin Center → Apps and integrations → Webhooks.
2. Click Create webhook.
3. Enter:

• Name (e.g., Send Ticket to CRM)
• Endpoint URL (https://myapp.com/zendesk-webhook)
• Request method: Usually POST
• Request format: JSON

Step 2 — Link to a trigger

1. Go to Admin Center → Objects and rules → Triggers.
2. Create a new trigger:

• Conditions: e.g., “Ticket is Created” AND “Priority is High”
• Action: “Notify active webhook” → Select your webhook

Add JSON payload:

{   "ticket_id": "{{ticket.id}}",   "status": "{{ticket.status}}",   "priority": "{{ticket.priority}}",   "subject": "{{ticket.title}}",   "description": "{{ticket.description}}" }

Step 3 — Handle the webhook request

Example in Node.js + Express:

const express = require('express');
const app = express();
app.use(express.json());

app.post('/zendesk-webhook', (req, res) => {
  console.log('Webhook received:', req.body);
  // Process the data (save to DB, send to Slack, etc.)
  res.status(200).send('OK');
});
app.listen(3000, () => console.log('Listening on port 3000'));

4. Securing Your Zendesk Webhook

Without security, anyone who finds your webhook URL could send fake requests. Zendesk supports two main verification methods:

Option 1: IP Allowlisting

Zendesk publishes a list of IP ranges they send webhook requests from: 🔗 Zendesk IP Addresses

You can allow only these IPs in your firewall or reverse proxy.

Example (NGINX):

nginx

location /zendesk-webhook {
    allow 192.0.2.0/24;
    allow 203.0.113.0/24;
    deny all;
    proxy_pass http://localhost:3000;
}

Pros:

• Easy to set up

Cons:

• Must update if Zendesk changes IP ranges
• Doesn’t stop spoofed requests from inside your network

Option 2: HMAC Signature Verification (Recommended)

Zendesk can send an HMAC-SHA256 signature with each webhook request. This lets you verify:

1. Authenticity — it came from Zendesk (knows your secret)
2. Integrity — the payload hasn’t been altered

How it works

Zendesk side:

• Takes the raw request body (bytes) and your shared secret
• Computes a SHA-256 HMAC hash
• Encodes it in Base64
• Sends it in the X-Zendesk-Webhook-Signature header

Your server side:

• Reads the raw request body before parsing JSON
• Computes the same hash with your secret
• Compares your hash to the header value

If they match → request is valid. If not → reject it.

Why rawBody is important

When Express parses JSON, it changes the body (removes spaces, changes quotes, etc.). Even tiny changes make the hash different. We store the original bytes in req.rawBody before parsing so our hash matches Zendesk’s.

Node.js HMAC verification example

const express = require('express');
const crypto = require('crypto');
const app = express();

const SHARED_SECRET = 'my_secret_from_zendesk';
// Keep raw body before parsing JSON
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

app.post('/zendesk-webhook', (req, res) => {
  const signature = req.headers['x-zendesk-webhook-signature'];

const hash = crypto
    .createHmac('sha256', SHARED_SECRET)
    .update(req.rawBody)
    .digest('base64');

 if (signature !== hash) {
    console.log('❌ Invalid signature');
    return res.status(401).send('Invalid signature');
  }

  console.log('✅ Verified webhook:', req.body);
  res.status(200).send('OK');
});

app.listen(3000, () => console.log('Listening on port 3000'));

Best security setup

• Use both IP allowlisting and HMAC verification for maximum protection.
• Keep your shared secret safe (never commit to GitHub).
• Respond within 10 seconds — Zendesk will retry if you take too long.
• Log failed verification attempts for investigation.

5. Testing Your Webhook

• Use Webhook.site to inspect requests
• Use ngrok to test local servers over HTTPS
• Send a test webhook from Zendesk’s admin panel to confirm setup

6. TIPS: How the comparison works

Here’s the verification process in plain steps:

Zendesk side:

hash = HMAC_SHA256(secret, raw_request_body)
signature = base64(hash)
send HTTP request with header:
  X-Zendesk-Webhook-Signature: signature

Your server side:

read raw request body into rawBody
my_hash = HMAC_SHA256(secret, rawBody)
my_signature = base64(my_hash)

if my_signature === request.headers['x-zendesk-webhook-signature']:
    ✅ verified - accept request
else:
    ❌ reject - possible tampering

Why not just trust HTTPS?

HTTPS encrypts the connection in transit, but it doesn’t prove who sent the request. Without signature verification:

• Anyone who finds your webhook URL could send fake requests.
• Zendesk wouldn’t be able to tell you about forged data.

The HMAC signature ensures authenticity (came from Zendesk) and integrity (wasn’t changed)

Conclusion

Zendesk webhooks are a powerful way to integrate your support platform with the rest of your business tools. But without security, they’re vulnerable to spoofing.

By combining:

• Triggers to send the right data at the right time
• HMAC signature verification to ensure authenticity
• IP allowlisting to block unwanted traffic

…you can create a fast, reliable, and secure Zendesk integration that scales.

happy coding ~