> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.thepennyinc.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server.

# Webhook Authorization

The `authentication_token` is a token you choose for outbound calls from Penny to your webhook receiver. It is separate from the API access token you send to Penny Banking. Penny includes the configured value in `Authorization: Bearer <token>` on event deliveries and Live Decisioning requests. Your receiver checks that value before processing a request.

## Configure the token

Supply `authentication_token` when you [create an endpoint](/platform/subscribing-to-webhooks), or replace it later:

```http
PATCH /notifications/webhooks/{notification_endpoint_id}
Content-Type: application/json

{ "authentication_token": "your-random-private-token" }
```

Generate a high-entropy token, store it securely on both sides, and compare the incoming bearer value with the stored value using a constant-time comparison. For example, Python's `secrets.token_urlsafe(32)` generates a suitable token. Require HTTPS for the endpoint URL.

## Change or remove it

`authentication_token` is write-only. Omit it from a PATCH to keep the existing value; send `"authentication_token": null` to remove it. A token change or removal sends the endpoint back through ownership verification. Webhook responses expose `has_authentication_token`, never the token itself, including when sensitive fields or history are requested. Keep the original value in your secret store because there is no read-back endpoint.

A bearer token checks that the caller knows a shared value. It does not sign the body or provide replay protection. For those checks, configure and [verify HMAC signatures](/platform/webhook-hmac) as well. If both are configured, require both checks before handling the request.