Payload Signature

Overview

How it works

Key risks include signing parsed rather than raw data, ambiguous serialization, leaked HMAC secrets, algorithm confusion, missing replay protection, proxy transformations, and accepting signatures after excessive delay. For Payload Signature, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration.

Useful measures include signature failures, replay rejections, unknown key IDs, verification latency, key-rotation success, and payload mutations detected after transit. Payload Signature is closely connected to Request Signature, Webhook Payload Validation, and Invoice Webhook.

Monitoring for Payload Signature should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials. The Payload Signature recovery process should restore access without bypassing the original identity and authorization controls. Least-privilege configuration for Payload Signature should be verified against the operations used by each environment and consuming service.

What matters in practice

A payload signature is a cryptographic value that lets a receiver verify integrity and the expected signing party for a defined message. Webhook HMACs often sign raw request bytes; reserializing JSON before verification can change the bytes and break validation. The verifier must know the algorithm, secret or public key, signed fields and key-rotation procedure. Compare MACs using timing-safe operations where relevant, and reject stale timestamps or reused event IDs to limit replay. A valid signature does not prove that the event's business data are complete or that settlement is final.

Related glossary concepts

Request Signature; Webhook Payload Validation; Invoice Webhook