ToolypetMCP
intermediate3 minutessecurity

Webhook Signature Verification

Verify incoming webhook signatures using HMAC to ensure requests are authentic and untampered.

webhookhmacverificationapi

このレシピの使いどころ

Services like Stripe, GitHub, and Slack sign webhook payloads with HMAC. Verifying these signatures prevents spoofed webhook attacks and ensures data integrity.

ステップ

1

Create the shared webhook secret

プロンプト:Generate a webhook signing secret (256-bit hex)
2

Compute the expected signature

プロンプト:Generate HMAC-SHA256 of the webhook payload using the signing secret
3

Verify by comparing signatures

プロンプト:Hash the received signature header for comparison

よくある質問

Why use HMAC for webhook verification?

HMAC ensures two things: the request came from the legitimate sender (authentication) and the payload wasn't modified in transit (integrity). Simple API keys only provide authentication.

What happens if I don't verify webhooks?

An attacker could send fake webhook events to your endpoint — triggering unauthorized actions like refunds, account changes, or data modifications.

関連レシピ