Webhooks · Segurança

Conferir a credencial

Todo aviso traz a credencial do ambiente no header X-Enviaesocial-Secret. Confira antes de confiar no corpo.

Os headers

X-Enviaesocial-Secret header

A credencial whsec_… do ambiente, a mesma que aparece no portal.

X-Enviaesocial-Delivery header

O uuid da entrega, igual ao do corpo.

X-Enviaesocial-Environment header

PRODUCTION ou RESTRICTED.

Passo a passo

Compare o header X-Enviaesocial-Secret com a credencial do portal. Diferente: responda 401.
Use o X-Enviaesocial-Delivery para descartar duplicata.

O código em PHP e em Node.js está no console, pronto para copiar.

{ "uuid": "6f1c2b7e-0a93-4d5e-b8c1-2f7a9e4d6b30", "type": "event.processed", "created_at": "2026-10-17T14:33:42-03:00", "data": { "event": { "uuid": "7c1e4f9a-3b2d-4e8f-9a61-0d5c2b8e4f17", "type": "S-2200", "layout": "S-1.3", "client_reference": "admissao-0042", "employer_document": "11222333000181", "status": "PROCESSED_SUCCESS", "response_code": "201", "protocol": "1.2.202610.0000000004817233", "receipt": "1.2.0000000048172331", "occurrences": [], "esocial_id": "ID1112223330000002026101714320800001", "period": null, "worker_cpf": "41872634036", "totalizers": [], "created_at": "2026-10-17T14:32:08-03:00", "updated_at": "2026-10-17T14:33:41-03:00", "processed_at": "2026-10-17T14:33:41-03:00" } }}

Content-Type: application/jsonUser-Agent: enviaesocial-webhooks/1X-Enviaesocial-Delivery: 6f1c2b7e-0a93-4d5e-b8c1-2f7a9e4d6b30X-Enviaesocial-Environment: RESTRICTEDX-Enviaesocial-Secret: whsec_8hT2…Qm4z

app.post('/webhooks/enviaesocial', express.json(), (req, res) => { if (req.get('X-Enviaesocial-Secret') !== process.env.ENVIAESOCIAL_WEBHOOK_SECRET) { return res.sendStatus(401); } res.sendStatus(200);});