Signed requests
Every endpoint you create issues its own signing key and accepts only signed requests. The sending server signs each submission together with a timestamp, and the signature is checked before anything is stored, so a submission cannot be altered in transit or replayed later.
Keys stay server-side
The signing key is held by the sending server and never appears in a web page, so it cannot be lifted from a browser. Keys are stored encrypted and shown once at the moment they are issued. If a key is lost or exposed, issue a new one — the old one stops working immediately.
Other protections
Endpoints can be switched off without being deleted, submissions are rate limited per sending address, and every rejected request is recorded in the Activity Log with the reason.
