> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moduluslabs.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Signatures

> Authenticate Payment Webhooks using Standard Webhooks headers and the endpoint signing secret

Every delivery includes:

* `Webhook-Id`
* `Webhook-Timestamp`
* `Webhook-Signature`

Use a maintained Standard Webhooks verification library with the
endpoint-specific `whsec_` secret. Give the verifier the exact raw request body;
JSON re-serialization changes the signed bytes and invalidates verification.

If implementing verification manually, sign:

```text theme={null}
{Webhook-Id}.{Webhook-Timestamp}.{raw request body}
```

Then Base64-decode the secret material after its `whsec_` prefix, calculate
HMAC-SHA256, and compare in constant time against every supported `v1`
signature in `Webhook-Signature`. Reject stale timestamps; a five-minute
tolerance is recommended.

<Warning>
  Verify before parsing or processing the payload. Never log signing secrets,
  signature material, API keys, full card numbers, CVV, or raw authorization
  credentials.
</Warning>