Verifying signatures
Always verify a webhook's signature before trusting its payload — anyone can send a POST to your endpoint URL.
How it works
Every delivery includes an x-relay-signature header: an HMAC-SHA256 hash of the raw request body (base64 encoded), signed with your webhook's signing secret (shown once when the webhook is created).
Verification example
Node.js
Python
Copyconst crypto = require('crypto');
function isValid(rawBody, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('base64');
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature)
);
}
Important — compute the HMAC over the raw request body, before JSON parsing. Re-serializing the parsed object will produce a different signature and always fail verification.