feat(signing): sign/verify webhooks with the request-signing key; deprecate webhook-signing#2239

Merged

bokelley merged 5 commits into

adcontextprotocol:mainfrom

BaiyuScope3:feat/webhook-verify-accept-request-signing-key

Jun 17, 2026

Commits on Jun 17, 2026

feat(signing): accept reused request-signing key for webhook delivery

authored and
bokelley
committed
fix(signing): use key_purpose_invalid for all webhook key-purpose failures

authored and
bokelley
committed
refactor(signing): webhooks use the request-signing key; deprecate webhook-signing

authored and
bokelley
committed
docs(signing): reference webhook-signing removal issue instead of 4.0

authored and
bokelley
committed
fix(signing): accept request-signing keys on webhook emission/auto-wire paths

authored and
bokelley
committed