What Is a Webhook Signature and Why Must You Validate It?

What is a webhook signature?

A webhook signature is a cryptographic value created from the request payload and a secret shared by the sender and receiver. Your endpoint recomputes the expected value and rejects the request when the values do not match.

Why signature validation is required

• Reject forged requests from unknown senders.
• Detect payload changes before processing an event.
• Combine timestamps or delivery identifiers with signature checks to reduce replay risk.

A safe verification sequence

1. Read the exact raw request body.
2. Parse the provider signature header according to that provider's format.
3. Compute the expected HMAC with the configured webhook secret.
4. Compare signatures with a constant-time comparison function.
5. Validate the timestamp or delivery identifier when the provider supplies one.
6. Reject invalid requests before parsing or acting on the event.

Implementation pitfalls

• JSON middleware can change whitespace or byte representation before verification.
• Header names, algorithms, encodings, and timestamp rules differ by provider.
• A leaked webhook secret must be rotated; signature verification cannot protect a secret that an attacker already has.

Primary references

• GitHub: Validating webhook deliveries
• Stripe: Receive events in your webhook endpoint