Route Callbacks to the Correct Tenant
Resolve a verified provider callback to the owning tenant before changing records.
A webhook callback arrives without a browser user. The receiver must identify the tenant that owns the provider connection. A tenant ID in the payload is not enough, even when the payload is signed. The signature proves the provider sent the bytes; it does not grant permission to change any tenant record. The OWASP Webhook Security Cheat Sheet covers signature and replay checks.
Callback binding flow
| Step | Required decision |
|---|---|
| Receive | Preserve raw body for signature verification |
| Authenticate | Verify provider signature or approved channel |
| Identify connection | Match provider account or event to stored connection |
| Resolve tenant | Use stored connection ownership |
| Authorize event | Check type and current connection state |
| Apply effect | Change only owning tenant records |
| Audit | Record decision without signing secret |
A provider may send events for many customer accounts to one endpoint. In that design, the account-to-connection map is a critical authorization input. Unknown accounts need a hold or rejection path. Do not guess a tenant from an email address or event description.
Verify with synthetic events
Create two test connections with distinct provider account IDs. Send signed test events through the provider sandbox or an owned fixture. Confirm A events affect only A records. Test an unknown account, a disconnected connection, a duplicate event, and a payload that names B while the stored connection belongs to A. Check database effects, queued work, and notifications after the receiver responds. Keep signing secrets and full payloads out of logs.
OWASP Multi Tenant Security supplies the ownership rule. This binding flow shows where an authentic event becomes an authorized tenant action. If the provider does not expose a stable account identifier, document the uncertainty and use a safer per-connection endpoint or other verified map. Do not test a third party's customer webhook without written scope.
If an event arrives before the connection record is committed, quarantine it with an owner and retry policy. Do not guess a tenant from the payload to keep processing. The quarantine should store only the minimum redacted evidence needed for reconciliation.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.