Asana (2026-05-18)

Webhook HMAC secrets are now persisted in crossFlowState keyed by context.flow.stableId so they survive deployments. The Webhook trigger continues to read its array of secrets, and the per-resource event triggers their single secret, from instance-state as a fallback when no crossFlowState value exists yet — customers whose webhooks are already registered see no interruption. The legacy instance-state slot is migrated to crossFlowState and cleared on the next inbound notification or heartbeat for that flow