Event Signature

Overview

An event signature authenticates a webhook, log event, message, or notification by signing defined bytes with a secret or private key. The recipient reconstructs the expected representation and verifies the signature before trusting the event.

Security depends on canonical serialization, algorithm choice, key identity, timestamp handling, secret protection, and replay defenses. Signing only part of a message or parsing fields differently can allow attackers to change meaning while preserving a technically valid signature.

Receivers should verify the raw body as specified, use constant-time comparison for MACs, enforce freshness, reject unsupported algorithms, and record event identifiers for deduplication. Signature validity proves message origin and integrity, not business authorization or successful processing.

An auditable record of Event Signature should link enrollment, signing, approval, broadcast, confirmation, revocation, and recovery events to the governing policy or model version, source evidence, decision, approver, exception, action, and final outcome.

An event signature is cryptographic evidence attached to an event message so recipients can verify its origin and detect modification. Event signatures protect authenticity and integrity only when the exact payload, context, freshness, and replay state are verified consistently.

A production treatment of Event Signature should test cryptographic evidence attached to an event message so recipients can verify its origin and detect modification within the relevant asset, decision, or service state. The Event Signature context record for cryptographic evidence attached to an event should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Event Signature should determine whether safeguards addressing cryptographic evidence attached to an event changed exposure in practice, not merely whether a document or setting existed.