Glossary
Webhook signature (HMAC-SHA256)
A keyed hash sent with each webhook so the receiver can prove the body came from the sender and was not changed.
- Standard
- RFC 2104 (HMAC)
- Also called
webhook-signature header,HMAC
At OneLifeVibe
- Each OneLifeVibe delivery carries webhook-id, webhook-timestamp (Unix seconds) and webhook-signature: v1= followed by the hex HMAC-SHA256 of "{timestamp}.{raw body}" with the endpoint secret. The secret is returned once, when the subscription is created.
- Verify against the raw body, before parsing, with a constant-time comparison, and reject timestamps more than 5 minutes away.
Related terms
See it working. The OneLifeVibe connector and Platform API put these pieces together.