Create a key to copy examples filled with your team.
Verify webhook requests
HMAC-SHA256 over {timestamp}.{body}.
Every delivery POST is signed with the endpoint secret. Receiving inbox webhooks use the same headers and the inbox webhook_secret.
Headers
| Header | Description |
|---|---|
X-Capsule-Timestamp |
Unix time as a string. |
X-Capsule-Signature |
sha256= plus hex HMAC-SHA256 of {timestamp}.{body}. |
Compute OpenSSL::HMAC.hexdigest("SHA256", secret, "{timestamp}.{body}") and compare it to the signature after stripping the sha256= prefix.
verify.rb
1
require "openssl"
2
3
expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{body}")
4
given = signature.to_s.delete_prefix("sha256=")
5
expected == given