Documentation

Problem Introduction

Your generic HMAC SHA-256 signature logic consistently fails when validating custom integrations.

Why It Happens

• •Empty bodies producing unexpected hashes
• •Middleware modifying raw request bytes
• •Using the API Key directly as the HMAC output

Step-by-Step Fix

1. 1Determine if the sender expects hashes encoded as hex or base64.
2. 2Skip validation entirely if the request body is genuinely empty/undefined.
3. 3Verify your routing middleware evaluates the payload as raw text or buffer.
4. 4Prevent timing attacks using secure buffer comparison utilities.

Common Mistakes

• •Defaulting to `hex` when the sender uses `base64`
• •Comparing hashes with standard strict equality `===` instead of timing-safe variants.

Debugging Workflow

Determine encoding expectations -> read raw payload directly -> generate HMAC -> compare.

Preventive Best Practices

• •Easily distinguish generic structural and prefix discrepancies out-of-the-box with Hookmetry.

Related Documentation