adaptlive

Verifying Webhook Signatures

Every webhook is HMAC-signed. Verify before trusting — anyone with your URL can send junk otherwise.

webhookshmacsha256securitysignature

Verifying Signatures

Every webhook from adaptlive includes an X-AdaptLive-Signature header. Verify it before trusting the payload — otherwise anyone with your URL can send you junk.

The header format

X-AdaptLive-Signature: t=1763846400,v1=a8f5f167f44f...

t is the Unix timestamp; v1 is the HMAC-SHA256 hex digest.

How to verify

  1. Concatenate {timestamp}.{raw_request_body}.
  2. HMAC-SHA256 it with your signing secret.
  3. Constant-time compare to the v1 value.
  4. Reject if the timestamp is older than 5 minutes (replay protection).

Node example

const expected = crypto
  .createHmac("sha256", SECRET)
  .update(`${t}.${rawBody}`)
  .digest("hex");
crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));

Don't compare with ==

Use a constant-time compare. String equality leaks timing info that lets an attacker brute-force the signature.

Was this article helpful?

← Back to Developer Tools

We use essential cookies to keep the app secure. Optional cookies help us improve reliability and measure campaigns. Cookie policy