Feature
Signed webhooks
HMAC-signed callbacks for publishes, approvals, CI tokens and drift.
The registry sends a signed HTTP POST when an allowed registry event fires. Payloads carry event metadata only, never package asset content or secrets, and X-Workloom-Signature holds an HMAC-SHA256 of the raw body.
Deliveries run off the request path with a timeout of about five seconds and up to three attempts with exponential backoff on 5xx responses and timeouts. Each delivery is logged and can be redelivered.
More features
All features →- 01
Home workspace package manager
Install, list, upgrade and remove AI config packages in your home directory.
- 02
Secrets that stay on your machine
{{secret:NAME}} references resolve locally at apply time, never in the registry.
- 03
Plugins and reversible settings
Settings edits you can undo, and plugins installed only from your allowlist.