Webhooks and integrations

Verify a webhook signature

Compute the signature over the raw request body, before any JSON parsing, and compare in constant time. Re-serialising the payload changes the bytes, and the signature will then never match.

Reviewed August 20, 2026

Steps

1. Capture the raw body as bytes. Most frameworks hand you a parsed object by default, which is already too late.
2. Compute the signature over those exact bytes with your endpoint secret.
3. Compare with a constant-time comparison rather than string equality.
4. Only parse the JSON once the signature has verified.
5. Reject anything that fails, and log the delivery id rather than the body.

How to check it worked

A genuine delivery verifies, and the same payload with one character changed does not.

What usually goes wrong

• Parsing then re-serialising before computing the signature.
• A body-parser middleware that consumes the stream before your handler sees it.
• Plain === on the signature, which leaks timing.