A webhook is an untrusted HTTP request until your application verifies it. Signature formats vary by provider, so verification must match the exact integration documentation.
01 / Preserve the signed bytes
Read the raw request body before parsing or reserializing JSON. The provider’s signature may cover those exact bytes, sometimes combined with other fields. Apply request-size limits before doing expensive work.
02 / Follow the provider’s scheme
Parse the documented header format, compute the expected authentication value and compare it using a constant-time function. Do not compare a structured header directly with a bare hash. Apply freshness checks where the scheme supports them.
03 / Separate receipt from processing
After verification, record or queue the event durably and acknowledge according to the provider’s retry contract. Use an event identifier or suitable deduplication key so retries cannot trigger duplicate fulfillment.
04 / Test the boundaries
Test an altered payload, wrong secret, malformed header, duplicate delivery and out-of-order event. When rotation is needed, define a limited overlap period and remove old secrets deliberately. Never log the secrets themselves.
Planning guidance. Confirm procedures against your software version’s documentation and seek qualified support for your environment. Reviewed October 31, 2026.