All Workfront Watch Events webhooks will be secured by default after August 23
Workfront Watch Event modules secured by default with authToken
Effective August 23, 2026, all Workfront Watch Event module subscriptions — including existing ones — will be protected by authToken-based verification by default. This ensures payloads delivered to your Fusion scenarios can be validated as originating from Workfront.
Overview
To improve webhook security, Fusion will be enabling authToken validation by default for the Watch Event modules. The authToken is a shared secret included with every webhook delivery so your receiving endpoint can verify the request before processing it. This change applies to both new subscriptions and any Watch Event modules you already have in active scenarios.
What’s changing
- All Workfront Watch Event module subscriptions will include an authToken with delivered payloads by default starting August 23, 2026.
- Fusion will automatically apply this security setting to existing Watch Event module webhooks — no manual migration or reconfiguration is required.
Why it’s changing
Without a shared secret, webhook endpoints cannot distinguish legitimate Workfront events from spoofed requests. A discovered webhook URL is otherwise open to anyone. The authToken provides a simple, effective way for your endpoint to validate that requests truly came from Workfront before taking action.
What this means for you
- On August 23, your existing Watch Event module scenarios will be secured by default; payloads will include an authToken you can verify at the receiver.
- No action is required to receive this protection: the setting will be enabled automatically for existing Watch Event subscriptions.
If you need to turn it off (compatibility only)
If a webhook breaks after this change and you need to disable authToken for compatibility, perform these steps before August 23, 2026:
- Open the scenario that contains the Watch Event module.
- Edit the module’s webhook.
- Disable the Enable secured hooks option.
- Save the module and re-activate the scenario.
We strongly recommend leaving authToken verification enabled unless your receiving endpoint explicitly cannot support it — disabling the setting removes the ability to verify that requests are genuinely from Workfront.
Where to find documentation
For technical details about the underlying mechanism and how to validate tokens, see the Event Subscription API docs and the Workfront / Workfront Planning connector documentation on Experience League:
Need help or want to give feedback?
If you have questions or encounter issues, post a comment below, start a thread in the Experience League Community, or contact Adobe Support through the Admin Console Support portal. Your feedback helps prioritize future enhancements.