How is the Tally.so webhook secured?

The webhook URL carries a key that is shown once and stored only as a hash, and you can set a signing secret so Tally.so signs every delivery and BytePhase verifies the signature before accepting it. Every request is rate-limited and scoped to your shop alone, and rotating the key instantly retires the old URL.