ToolypetMCP
intermediate4 minutessecurity

HMAC Webhook Security Chain

Implement complete webhook security: generate shared secret, sign payloads, and verify signatures.

hmacwebhooksignatureverificationapi

इस रेसिपी का उपयोग कब करें

Implement webhook security like Stripe, GitHub, and Shopify use. HMAC signing ensures webhook payloads are authentic and untampered.

चरण

1

Create shared secret

प्रॉम्प्ट:Generate a 256-bit hex webhook signing secret
2

Sign the webhook payload

प्रॉम्प्ट:Generate HMAC-SHA256 of payload '{"event":"payment.completed","amount":99.99}' using the secret
3

Verify signature match

प्रॉम्प्ट:Regenerate HMAC with the same payload and secret to verify signatures match (simulating receiver)
4

Add replay protection

प्रॉम्प्ट:Include a timestamp in the signature to prevent replay attacks — show current Unix timestamp

अक्सर पूछे जाने वाले प्रश्न

How do I prevent webhook replay attacks?

Include a timestamp in the signed payload. Reject requests older than 5 minutes. Some implementations also include a nonce (unique ID per request) to prevent exact replays.

What if the HMAC doesn't match?

Return 401 Unauthorized and log the attempt. Common causes: wrong secret, payload modification by middleware (whitespace, encoding), or using the wrong HMAC algorithm.

संबंधित रेसिपी