Webhook Signature

ELI5 — The Vibe Check

A webhook signature is like the wax seal on a medieval letter — it proves the message actually came from who it says it came from and wasn't tampered with. Without checking signatures, anyone could send a fake 'payment successful' webhook to your server and get free stuff. It's a hash of the payload + a secret that only you and the sender know.

Real Talk

Webhook signatures are cryptographic hashes (typically HMAC-SHA256) included in webhook HTTP headers to verify the authenticity and integrity of webhook payloads. The signature is computed using a shared secret between the webhook sender and receiver. Verification prevents replay attacks and payload tampering.

When You'll Hear This

"Always verify Stripe's webhook signature before processing — skipping this is a security hole." / "We reject any webhook where the computed HMAC doesn't match the signature header."