Skip to main content

Re-Create a secret for signing webhook requests

PUT 
/webhooks/public/webhooks/secret

Verifying the X-Signature header

Each request we send includes these headers:

  • Content-Type: application/json
  • X-Signature — HMAC-SHA256 of the request body, as a lowercase hex string
  • X-RequestId — a unique GUID per request

To verify a request:

  1. Read the raw request body exactly as received (the UTF-8 bytes). Do not parse, re-serialize, or reformat the JSON — any whitespace change breaks the signature.
  2. Compute HMAC-SHA256(body, secret) using your shared secret (UTF-8 bytes) as the key.
  3. Encode the result as a lowercase hexadecimal string (no separators).
  4. Compare it to the X-Signature header using a constant-time comparison. If they don't match, reject the request.

Responses​

OK