Authenticating Inbound Webhooks

Two Auth Mechanisms

TrackDrive accepts an auth token in either of two places
on inbound webhook requests to TrackDrive (Postback or Post):

• As an Authorization: Bearer <token> header.
• As an Authorization: Token <token> header.

There is no separate "Basic Auth" field on the inbound
webhook record. If a traffic source insists on Basic Auth,
the credentials must be encoded into the Authorization
header by the caller.

Company Access Token

The token presented must be the company's access token.
TrackDrive confirms the token belongs to the same company
that owns the vanity URL. A mismatch returns 401 without
revealing which side of the check failed.