Webhook Signature Verification

🔐 Webhook Signature Verification

All webhooks sent from Apara are signed using a dedicated secret key shared only between Apara and the customer. This ensures the integrity and authenticity of webhook data.

🧠 How It Works

Apara uses HMAC (Hash-based Message Authentication Code) with SHA256 for webhook authentication.

🔑 Required Inputs

1. Request Body → Raw HTTP request payload

2. Dedicated Secret Key → Provided by Apara

⚙️ Verification Flow

1. Receive webhook request from Apara

2. Extract:

   • Raw request body

   • X-Apara-Hmac-Hash header

3. Generate HMAC hash using:

   • SHA256 algorithm

   • Your dedicated secret key

4. Compare generated hash with received signature

✅ Validation Logic

• If both hashes match → Webhook is valid

• If hashes do not match → Webhook is invalid

⚠️ Ignoring Events

Customers may choose to skip processing certain webhook events based on their business logic.

💻 Code Examples

Node.js

const crypto = require("crypto");
const dedicatedSecret = ""; //- latest sandbox-secret in displ-ai

const body = {}; //paste your body 

const signature = ""; //paste your signature

const hash = crypto
  .createHmac("sha256", dedicatedSecret)
  .update(JSON.stringify(body))
  .digest("hex");
console.log(hash === signature);