HMAC signature.
also: HMAC · HMAC-SHA256 · HMAC signatures · webhook signature · replay attack · replay attacksA hash of the payload keyed with a shared secret, sent with a webhook so the receiver can check it is authentic and untampered.
the two-minute refresher
- Sender: signature = HMAC-SHA256(secret, timestamp + raw body), sent in a header.
- Receiver recomputes it over the exact raw bytes and compares in constant time.
- Sign and send the same bytes: re-serialising JSON changes spacing and breaks the match.
- Include a timestamp and reject old messages, or attackers can replay them.