Generic HMAC-SHA256 webhook validation
Use Generic HMAC-SHA256 for a sender that signs the raw request body with HMAC-SHA256 and puts the result in a supported header.
Supported signature headers
| Header precedence | Accepted value |
|---|---|
| x-hmac-signature | hex digest or sha256=<hex digest> |
| x-signature | hex digest or sha256=<hex digest> |
| x-webhook-signature | hex digest or sha256=<hex digest> |
| signature | hex digest or sha256=<hex digest> |
Configure the sender
- Create an endpoint with Generic HMAC-SHA256 validation.
- Record the generated secret when it is displayed.
- Configure the sender to calculate HMAC-SHA256 over the exact body bytes with that secret.
- Set one supported signature header and send a test request.