Verifying webhook signatures

Both rule webhooks and webhook egress sign each request so you can trust it.

To verify:

  1. Compute HMAC_SHA256(secret, rawBody) as hex on your server.
  2. Compare it to the header value using a constant-time comparison.
  3. Reject the request if they don't match.

Use the exact raw bytes of the body (don't re-serialize parsed JSON) or the hash won't match. Keep the secret private; rotate it if exposed.

More in Integrations
Streaming your data out (egress overview)
Forward telemetry to your own systems — webhook, InfluxDB, MariaDB, Kafka.
Egress: webhook destination
POST each reading to your own HTTP endpoint.
Egress: InfluxDB
Write telemetry into an InfluxDB v2 bucket.
Egress: MariaDB / MySQL
Insert telemetry rows into a MariaDB/MySQL table.
Egress: Kafka
Publish telemetry to a Kafka topic.
Actuator MQTT command contract (no gateway)
Build your own MQTT-capable actuator that the platform can command directly, without a gateway — topics, command payloa…