Custom Webhook Action: Secure Credentials in Sparkforge

The Custom Webhook action in Sparkforge automations now stores credentials behind masked secret keys. Stop pasting tokens into plain-text fields and start managing them by name.

What changed

• Masked secret keys for Basic auth, Bearer token, and API key authentication.
• Secure storage — keys are stored encrypted and never displayed in plain text after save.
• Identification by name — dropdowns show the key name, not the secret.
• Location-level scope — keys are accessible only inside the location where they were created.
• Restricted deletion — only the key creator or an agency admin can delete a key.

Add a Custom Webhook with masked credentials

1. In your Automations builder, add a step and choose Custom Webhook.
2. Pick the authentication type: Basic auth, Bearer token, or API key.
3. Configure credentials:
   • Choose Create New Key.
   • Enter a key name (for identification) and the key value (the actual credential).
   • Save. The key is now masked and referenced by name.
4. Use the dropdown to select an existing key on future webhook actions, or to delete keys you no longer need.

Why this matters

• Lower exposure risk — secrets aren’t printed in the UI, so accidental screen-shares stop leaking credentials.
• Cleaner access control — only the creator and admins can remove a key.
• Reusable credentials — store an API key once and reference it across every webhook step in the location.

Important notes

• Only agency admins or the key creator can delete a key.
• Updating a key replaces the old value — the previous secret is removed automatically.