Webhook Verification
Here is a guide on how to verify Sendstack webhooks:
Obtain the signature: When you receive a webhook event, it includes a signature in the
x-sendstack-signature
header. This signature is generated by computing an HMAC with the SHA256 hash function, using your App Secret as the key, and thewebhookId
on the payload object.Compute your own signature: To verify the authenticity of the webhook event, you need to compute your own signature using the same method as above. You can do this by computing an HMAC with the SHA256 hash function, using your App secret as the key, and the
webhookId
property on the payload as the message.Compare signatures: Once you have computed your own signature, you can compare it to the signature provided in the
x-sendstack-signature
header. If the two signatures match, then you can be sure that the webhook event was sent by Sendstack and has not been tampered with.
You can use a similar function as displayed below:
Last updated