Skip to main content
Every delivery includes:
  • Webhook-Id
  • Webhook-Timestamp
  • Webhook-Signature
Use a maintained Standard Webhooks verification library with the endpoint-specific whsec_ secret. Give the verifier the exact raw request body; JSON re-serialization changes the signed bytes and invalidates verification. If implementing verification manually, sign:
Then Base64-decode the secret material after its whsec_ prefix, calculate HMAC-SHA256, and compare in constant time against every supported v1 signature in Webhook-Signature. Reject stale timestamps; a five-minute tolerance is recommended.
Verify before parsing or processing the payload. Never log signing secrets, signature material, API keys, full card numbers, CVV, or raw authorization credentials.