Verifying Signatures
Every webhook from adaptlive includes an X-AdaptLive-Signature header. Verify it before trusting the payload — otherwise anyone with your URL can send you junk.
The header format
X-AdaptLive-Signature: t=1763846400,v1=a8f5f167f44f...
t is the Unix timestamp; v1 is the HMAC-SHA256 hex digest.
How to verify
- Concatenate
{timestamp}.{raw_request_body}. - HMAC-SHA256 it with your signing secret.
- Constant-time compare to the
v1value. - Reject if the timestamp is older than 5 minutes (replay protection).
Node example
const expected = crypto
.createHmac("sha256", SECRET)
.update(`${t}.${rawBody}`)
.digest("hex");
crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
Don't compare with ==
Use a constant-time compare. String equality leaks timing info that lets an attacker brute-force the signature.
