Webhook Signatures

Overview

Every webhook request is signed with HMAC-SHA256. Always verify signatures to prevent spoofed requests. See Verifying Signatures for implementation details.

Verification Flow

1. Read the raw request body
2. Read the x-dash4devs-signature header
3. Compute HMAC-SHA256 of the body using your webhook secret
4. Compare using constant-time comparison

import crypto from "crypto"

const expected = crypto.createHmac("sha256", WEBHOOK_SECRET).update(body).digest("hex")
const valid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))

Next Steps

• Verifying Signatures — Full implementation
• Webhook Overview — Setting up webhooks