Webhook Signature Verification

Webhook Signature Verification

Verify webhook authenticity using HMAC signatures.

How It Works

Every webhook includes a signature header:

X-Webhook-Signature: abc123...

This is an HMAC-SHA256 hash of the payload (as a hex string) using your webhook secret. The webhook event type is also sent in the X-Webhook-Event header.

Getting Your Secret

Verification Code

JavaScript/Node.js

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  return expected === signature;
}

// In your endpoint
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const isValid = verifySignature(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook...
  res.status(200).send('OK');
});

Python

import hmac
import hashlib

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return expected == signature

Security Best Practices