A webhook signature is a cryptographic check that verifies a webhook request came from its expected sender and was not changed. It is usually sent in an HTTP header and checked with a shared secret or public key before an application acts on the event. A valid signature does not by itself prevent replayed requests, so timestamp validation and idempotent event handling also matter.
Webhook Signature
What Is a Webhook Signature?
A webhook signature is a cryptographic check that confirms a webhook request came from the expected software service and was not altered. A webhook sends an HTTP event notification, while its signature usually arrives in a request header.
How Webhook Signature Verification Works
Verify the request before your application trusts or acts on it.
- Keep the exact raw request bytes.
- Read the signature header and timestamp.
- Calculate the expected HMAC or verify the public-key signature.
- Use constant-time comparison or the provider's SDK.
- Reject failures, then safely record the event.
HMAC vs Public-Key Webhook Signatures
Providers choose one of two common signing approaches.
| Method | Receiver stores | Signing ability |
|---|---|---|
| HMAC | Shared secret | Either holder of the secret |
| Public key | Public key | Only the private-key holder |
Benefits of Verifying Webhook Signatures
Verification creates a safer boundary around an endpoint.
- Blocks forged event requests.
- Detects changed payloads.
- Protects automated actions.
Practical Limits of Webhook Signatures
A valid signature is necessary, not sufficient.
- Use HTTPS and secure secret storage.
- Reject stale timestamps to limit replays.
- Handle duplicate events with idempotency.
- Apply rate limits and authorization checks.
Webhook Signature Best Practices
Small implementation details determine whether verification works.
- Use the official verifier when available.
- Verify raw bytes before parsing or side effects.
- Rotate keys with an overlap period.
- Log safe metadata, not secrets or full payloads.
- Test valid, altered, stale, and duplicate deliveries.
Webhook Signatures in Emergent
Emergent can help build full-stack integrations that verify incoming events before processing them, including e-signature workflows. Explore related terms in the Emergent glossary to plan secure integrations.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
Is there a way to verify a webhook signature?
Yes. Preserve the raw request body, use the provider's signing secret or public key, and compare the calculated result with the signature header before processing the event.
How do you verify Stripe webhook signatures?
Use Stripe's official webhook verification utility with the unmodified request body, the Stripe-Signature header, and your endpoint signing secret. Reject requests that fail verification.
Are webhooks safe to use?
They can be safe when protected with HTTPS, signature verification, timestamp checks, secret storage, rate limits, and idempotent event handling.
How do you use webhooks for e-signatures?
Configure an e-signature provider to send events such as completed or declined documents to your endpoint. Verify each signature before updating your application or notifying users.
Start Building
on Emergent today
on Emergent today
Start Building
