Enterprise API and Webhooks
Verify webhook signatures
Webhook payloads include timestamp and signature headers so customer systems can confirm the request came from Signrrett.
Steps to follow
- 1
Read the x-signrrett-timestamp header and raw request body.
- 2
Read the t timestamp and v1 signature values from x-signrrett-signature, and confirm its timestamp matches x-signrrett-timestamp.
- 3
Create a string using timestamp, a period, and the unchanged raw body.
- 4
Use the endpoint secret to calculate an HMAC SHA-256 signature.
- 5
Compare the calculated signature to the v1 value with a timing-safe comparison.
- 6
Reject webhook calls when the signature does not match or the timestamp is more than five minutes old.
