hi @Kithi

Not sure this is the exact answer you are after. If you use seamless authentication monday will send you an encrypted shortLivedToken when posting to your app’s action endpoint. The header contains the authorization which can be used to:

1. verify the post is signed correctly


2. retrieve the shortLivedToken

For (1) you probably want to add some middleware in your routes, like:

router.post("/app-end-point/recipeaction", authenticationMiddleware.authMonday, autoIdColumnController.recipeAction);

In this case the middleware (authenticationMiddleware.authMonday) verifies the post with:

async function authMonday(req, res, next) {



  try {

    let { authorization } = req.headers;

    let { challenge } = req.body;

    //The challenge from the webhook is not signed

    if (challenge) return next();

    if (!authorization && req.query) {

      authorization = req.query.shortLivedToken;

    }

    const { accountId, userId, backToUrl } = jwt.verify(authorization, mySigningSecret);

    req.session = { accountId, userId, backToUrl };

    next();

  } catch (err) {

    res.status(401).json({ error: "not authenticated" });

  }

}

The variable mySigningSecret can be found on your app’s page in the Developers section.

For (2) your action endpoint can do something like this:

const { accountId, userId, aud, exp, iat, shortLivedToken } = jwt.verify(authorization, mySigningSecret);

to obtain the shortLivedToken. This token can be used in all monday API calls.

In general the .env file is not the best place to store secrets, just Google “is nodejs .env file safe for secrets”

Hi @basdebruin

1. How to handle signing secret for production users?

I understand that I need the signing secret to retrieve the short-lived token from a Monday.com request.

For testing, I manually copied the signing secret from my developer account and added it to my Node.js .env file. However, when our app goes live, how should I obtain the signing secret for each user?

• Should I ask the user to enter it manually via the UI?


• Or is there an official method or workaround provided by the Monday.com platform to access it securely?

2. Unauthorized error while forwarding Twilio webhook payload

I have a custom trigger in my Monday.com app, which provides a webhookUrl.

Separately, I’ve created a webhook in Twilio, with its callback URL pointing to our own middleware endpoint.

Here’s the flow:

1. Twilio sends the payload to our middleware.


2. Our middleware processes it.


3. We forward the payload to Monday.com using the webhookUrl received from the custom trigger.

However, when sending this request to the webhookUrl, I get an “Unauthorized” error.

I’m using my Monday API token to make the request.

Is there something I’m missing regarding authentication when calling the webhookUrl from a backend service?

Any help or guidance would be greatly appreciated!

Thanks in advance 🙏

The signing secret is for the app, it is not per user. You should store it in a safe place where you retrieve it through NodeJS code.

The webhook in monday send a post to the endpoint when the criteria is met (e.g. wehn a new item is created send a webhook). You can’t post to that webhook from an outside app.

Hi @basdebruin

Thank you. If I had any doubt, I would ask here.