Profile My skills Saved Collections Edit profile Submit a skill

API Webhook Signature Verification

Verify webhook signatures with HMAC-SHA256 over the raw body, constant-time compare, timestamp replay windows, and idempotent handling. Use when implementing or reviewing webhook receivers or providers.

deangrant 9c7d566 4 files · 1.7 KB Updated
Integrations & APIs

File contents

Webhook Signature Verification

Use this skill when signing or verifying webhook payloads.

1. Provider

Sign the raw body bytes (not re-serialized JSON) with HMAC-SHA256 (or documented scheme). Include timestamp in the signed content. Rotate secrets.

2. Receiver

  • Read raw body before JSON parse.
  • Compute expected HMAC; constant-time compare.
  • Reject if timestamp outside skew window (replay).
  • Dedupe on event id (idempotent processing).

3. Quick checklist

  • Raw body signed/verified.
  • Constant-time compare.
  • Timestamp window enforced.
  • Secrets not logged; rotation supported.
  • Idempotent event handling.

See reference.md and examples.md.

deangrant/agents/tree/main/.agents/skills/api-webhook-signature-verification commit 9c7d566e9d

Browse category

Frequently asked questions

npx skillmds@latest add deangrant/api-webhook-signature-verification