The v1 API and v2 API share the same secret and webhook URL, both configured on the dashboard.
Securing
Webhooks are secured via a JWT Token (usingHS256), sent from the server, that can be validated by the client. There are client libraries for JWTs in almost every language, with great documentation.
The payload of the JWT will include 2 keys. iat is the time that the token was issued as a unix timestamp. And notification_id, the id of the notification being sent in the webhook.
The token will be sent in the authorization header.
The shared secret to validate each token can be created on the account page on the dashboard.
Payload
The body of the webhook specifies the event, in this casev2_availability_alert_notification and the data associated with the alert notification.
All the fields below are required with the exception of alert_metadata.