Anyone can send a request to your webhook URL, so check every delivery before you act on it. Each one is signed with your endpoint's signing secret and carries two headers:
X-EmbodiFlow-Timestamp: Unix seconds.X-EmbodiFlow-Signature:v1=<hex>. While a secret is being rotated it holds several values separated by commas; accept the delivery if any of them matches.
Verify
Checking a signature takes three steps:
- Build the signed string: the timestamp, a dot, then the raw request body bytes, that is
timestamp + "." + body. Use the body exactly as received; don't parse and re-serialize the JSON. - Compute the HMAC-SHA256 of that string with your signing secret, and compare the hex digest in constant time.
- Reject any timestamp more than 300 seconds away from your clock, so an old delivery can't be replayed against you.
Worked example
Use this to test your code. With the secret whsec_example_do_not_use, the timestamp 1710000000 and this body:
{"id":"c0a1e014-8000-5111-8148-000000000001","type":"workflow.run.succeeded","specVersion":1,"occurredAt":"2024-03-09T16:00:00.000Z","tenantId":"01900000-0000-7000-8000-000000000001","projectId":"01900000-0000-7000-8000-000000000002","resource":{"type":"workflow_run","id":"01900000-0000-7000-8000-000000000003"},"data":{"workflowRunId":"01900000-0000-7000-8000-000000000003","status":"succeeded"}}your code should produce the HMAC-SHA256 hex db77a488491b575ab3bc5d1f305065bba69ec10e9ac893a10c8c94adc58a14bf.