Verify webhook signatures
Authenticate the exact bytes, enforce timestamp tolerance, and reject replayed or altered deliveries.
Read the raw request body, combine the documented timestamp and payload in the signing input, compute HMAC with the subscription secret, and compare signatures in constant time. Reject stale timestamps and deduplicate valid event IDs after verification.
What this means in practice
Read the raw request body, combine the documented timestamp and payload in the signing input, compute HMAC with the subscription secret, and compare signatures in constant time. Reject stale timestamps and deduplicate valid event IDs after verification.
Use the documented brand and account boundaries consistently across the scheduler, REST API, SDK, MCP tools, SSE consumers, and webhooks. That makes the same social operation explainable to an operator and reproducible by an integration.
Implementation checklist
Capture the raw body before JSON middleware changes spacing or encoding.
Read the signature and timestamp headers exactly as documented.
Reject missing, malformed, stale, or future-skewed timestamps.
Use constant-time comparison for the expected and received signature.
Rotate secrets with an overlap strategy that identifies which subscription signed the event.
Operational details
Signature verification authenticates delivery content; it does not eliminate the need for idempotent event processing.
Clock synchronization matters when enforcing a narrow replay window.
Test both rotated secrets during the overlap window.
Store only safe diagnostic information on verification failure.
Common mistakes to avoid
- Do not compute HMAC over reserialized JSON.
- Do not log the signing secret or full Authorization headers during debugging.
- Do not accept an old valid signature indefinitely.