Webhook signature validation
Hookmetry validates captured requests against the endpoint configuration. This helps diagnose a received request; it does not validate requests on behalf of your application server.
Supported validation types
| Validation type | Signature header | Behavior |
|---|---|---|
| Stripe | stripe-signature | Rejects timestamps more than 300 seconds from the current server time. |
| GitHub | x-hub-signature-256 or x-hub-signature | Accepts SHA-256 and legacy SHA-1 prefixes. |
| Generic HMAC-SHA256 | x-hmac-signature, x-signature, x-webhook-signature, or signature | Accepts an optional sha256= prefix. |
Raw request body
Validation hashes the raw request body with the endpoint secret and compares the result using a timing-safe comparison. Changing whitespace, character encoding, or JSON serialization changes the bytes being signed.
Choose the endpoint validator
When creating an endpoint, choose None, Stripe, GitHub, or Generic HMAC-SHA256. Use the validator whose signature header and signing contract match the sender.