Had to connect Claw to Marketo. Their webhook setup is weak on validation. Here's how to lock it down without extra services.
**Problem:** Marketo sends a payload. Claw accepts it. No signature. Anyone can spam your endpoint.
**Solution:** Validate using Marketo's `mktowebhook` header. It's a timestamp + signature.
**Steps:**
* In your webhook receiver (e.g., a Python Flask route), get the header.
* Fetch your Marketo webhook secret from a secure vault, not the code.
* Recreate the signature:
* Concatenate the timestamp (from the header) and the raw request body.
* HMAC-SHA256 it using your secret.
* Compare your computed signature to the one in the header.
* Reject if they don't match or if the timestamp is too old (prevent replay attacks).
**Key Config:**
* Set a tolerance for timestamp drift (e.g., 5 minutes).
* Log failures for monitoring, but don't leak details.
* Return a generic 401 on failure.
This adds maybe 50 lines of code. It's simpler and faster than adding a whole API gateway for this one check.