HMAC signature
An HMAC signature is a keyed hash sent with a webhook, proving to the receiver that the request is genuine and unaltered.
In detail
Here the header is formatted t=<unix-seconds>,v1=<hex>, where the v1 value is the HMAC-SHA256 of the timestamp, a dot, and the raw request body, keyed with the endpoint secret. Sign the raw bytes before any JSON parsing — a re-serialised body will not match — and compare in constant time. Reject timestamps older than five minutes so a captured delivery cannot be replayed at you later.
Also known as
- signed webhook
- request signature