Authenticating Inbound Webhooks

Two Auth Mechanisms

TrackDrive accepts an auth token in either of two places on inbound webhook requests to TrackDrive (Postback or Post):

• As an Authorization: Bearer <token> header.
• As an Authorization: Token <token> header.

There is no separate "Basic Auth" field on the inbound webhook record. If a traffic source insists on Basic Auth, the credentials must be encoded into the Authorization header by the caller.

Company Access Token

The token presented must be the company's access token. TrackDrive confirms the token belongs to the same company that owns the vanity URL. A mismatch returns 401 error without revealing which side of the check failed.