Several Meraki networks post alert webhooks to one internal service, and someone has begun sending look-alike events from a public test server. The receiver must prove each alert came from the configured dashboard by validating the shared secret, log the outcome, and answer quickly. Which shared-secret check should run before the receiver processes an alert?

Meraki's webhook design skips payload signing entirely, so when a sharedSecret is configured for the HTTP server, the dashboard writes it into the JSON body of each alert and expects the receiver to compare it against its own stored copy before trusting the message. Doing that comparison first means an impostor posting look-alike events never reaches your business logic, and because the secret is optional, an empty or missing value must count as a failure rather than a silent pass. Logging both outcomes gives you an audit trail and makes repeated mismatches visible, and the comparison itself is a string match, so the receiver still answers quickly. Matching the sender address against an allowlist you maintain leans on network origin instead of the secret this scenario requires, and addresses change when deliveries arrive from different infrastructure. Answering 200 first and validating afterwards is deferred validation, but it runs the event handler before authenticity is proven, so a fake alert can write records you must later unwind. Dropping a mismatch with no log satisfies the secret test while discarding the audit requirement, hiding the probing. Exam caveat: a custom payload template can reshape or remove body fields, so confirm what your receiver actually parses. Practical check: send a dashboard test alert with a wrong secret and verify it is rejected and logged.