{% extends "layouts/workspace_settings.html" %}
{% block title %}Webhook secret · DemandTrail Messaging{% endblock %}
{% block page_header %}<h1 class="page-title mb-4">{{ heading }}</h1>{% endblock %}

{% block content %}
  {% comment %}
  Rendered in the response to the POST that minted it rather than after a
  redirect: the messages framework stores in the session, which is a database
  table in this project, so a redirect-then-show would park a live secret there
  for the life of the session (SECURITY-BASELINE §5).
  {% endcomment %}
  <p><strong>Copy this secret into your receiver now.</strong></p>
  <p><code>{{ plaintext }}</code></p>

  <p class="muted">
    Deliveries to <code>{{ webhook.url }}</code> carry
    <code>X-BrightBean-Signature</code>, an HMAC-SHA256 over the timestamp and
    the raw body keyed on this secret. The
    <a href="{% url 'api_docs' %}">API reference</a> has a verification snippet
    you can paste into your receiver.
  </p>

  <p><a href="{{ back_url }}">Done</a></p>
{% endblock %}