What if my Typeform webhook URL is shared by mistake?

Treat the webhook URL as a password, because it contains your BytePhase API key. If it leaks, click Rotate key on the integration’s Activity screen. The old URL stops working at once and BytePhase shows a new webhook URL to paste into Typeform. With the signing secret switched on, a delivery without a valid Typeform signature is rejected anyway.