Verifying Signatures
Validate webhook authenticity using HMAC signatures.
Updated
On this page
Why Verify?
Always verify webhook signatures to ensure the request genuinely came from DashForDevs and hasn't been tampered with. Without verification, anyone could send fake events to your endpoint.
How Signatures Work
Every webhook request includes an x-dash4devs-signature header containing an HMAC-SHA256 hash of the request body, signed with your webhook secret.
Verification in Node.js
import crypto from "crypto"
function verifyWebhookSignature(
body: string,
signature: string,
secret: string
): boolean {
const expected = crypto
.createHmac("sha256", secret)
.update(body)
.digest("hex")
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
)
}
Important: Always use
timingSafeEqual instead of === to prevent timing attacks.
Next.js API Route Example
// app/api/webhooks/dash4devs/route.ts
import { NextRequest, NextResponse } from "next/server"
import crypto from "crypto"
const SECRET = process.env.DASH4DEVS_WEBHOOK_SECRET!
export async function POST(req: NextRequest) {
const body = await req.text()
const signature = req.headers.get("x-dash4devs-signature") || ""
const expected = crypto
.createHmac("sha256", SECRET)
.update(body)
.digest("hex")
const valid = crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
)
if (!valid) {
return NextResponse.json({ error: "Invalid signature" }, { status: 401 })
}
const event = JSON.parse(body)
// Process the verified event...
return NextResponse.json({ received: true })
}
Verification in Python
import hmac
import hashlib
def verify_signature(body: bytes, signature: str, secret: str) -> bool:
expected = hmac.new(
secret.encode(),
body,
hashlib.sha256
).hexdigest()
return hmac.compare_digest(signature, expected)
Getting Your Webhook Secret
- Go to Settings → Webhooks in the dashboard
- Click on your webhook endpoint
- Copy the signing secret
- Store it as an environment variable (never hardcode it)
# .env
DASH4DEVS_WEBHOOK_SECRET=whsec_your_signing_secret_here
Next Steps
- Webhook Overview — Setting up webhooks
- Event Types — All available events
- Security: Webhook Signatures — Advanced security considerations