Verifying webhook signatures
Both rule webhooks and webhook egress sign each request so you can trust it.
- Header:
X-Synacl-Signature: sha256=<hex> - The value is an HMAC-SHA256 of the raw request body using the secret you configured.
To verify:
- Compute
HMAC_SHA256(secret, rawBody)as hex on your server. - Compare it to the header value using a constant-time comparison.
- Reject the request if they don't match.
Use the exact raw bytes of the body (don't re-serialize parsed JSON) or the hash won't match. Keep the secret private; rotate it if exposed.
Requests with no body. A User Action using GET sends nothing to sign, so the signature is the HMAC of an empty string. Treat that as proof the caller holds your secret — it says nothing about payload integrity, because there is no payload.
The header cannot be spoofed by your own config. If you add a custom header called X-Synacl-Signature, Synacl rejects it when you save; the signature you receive is always the one Synacl computed.