Webhook Signing

Webhook signing is how a service proves to your app that an incoming webhook actually came from it and wasn't forged or tampered with. Because a webhook is just an HTTP request hitting a public URL, anyone who discovers that URL could POST fake events. To prevent this, the sender computes a cryptographic signature — typically an HMAC of the raw request body using a shared secret — and includes it in a header; your endpoint recomputes the same HMAC with your copy of the secret and rejects the request if they don't match. This verifies both authenticity and integrity. Stripe, GitHub, and most serious webhook providers sign this way. For AI/SaaS builders consuming webhooks — payment events, deployment notifications, third-party updates — verifying the signature is a non-negotiable security step; an unverified webhook handler that mutates data is an open door. Practical note: sign against the exact raw bytes of the body (not the parsed JSON), guard against replay attacks with the included timestamp, and use a constant-time comparison to avoid timing leaks.