Webhook Signature Verification
Pronunciation: WEB-hook SIG-nuh-cher vair-ih-fih-KAY-shun
Definition
Webhook Signature Verification is an asynchronous integration concept that cryptographically checks that a webhook came from a trusted signer and that covered data was not altered. Webhook Signature Verification delivery confirms only transport to the configured consumer; it does not by itself prove that downstream payment, accounting, or fulfillment processing succeeded. Webhook Signature Verification must specify the producer, consumer, event type and version, delivery URL, stable event identifier, signature method, timestamp, retry policy, and expected response.
Overview
Webhook Signature Verification is an asynchronous integration concept that cryptographically checks that a webhook came from a trusted signer and that covered data was not altered. Webhook Signature Verification specifically performs the cryptographic and freshness checks needed to accept or reject a signed webhook delivery. The receiver obtains the raw request bytes and required headers, reconstructs the exact signed message, selects the correct key and algorithm, and compares the expected signature with the provided value. Verification alone does not establish freshness, authorization for every business transition, or payload correctness. Implementations should enforce approved algorithms and keys, exact canonicalization, bounded timestamp skew, replay detection, and safe comparison. Loose parsing, algorithm confusion, untrusted key identifiers, and non-constant comparison can weaken implementation. After success, schema, resource identity, amount, status, and legal transition still require validation. Monitoring for Webhook Signature Verification should track delivery age, signature failures, duplicate rate, retry exhaustion, and unresolved business events. Business actions triggered by Webhook Signature Verification should be idempotent and should verify the current object state before fulfillment or accounting updates. A Webhook Signature Verification handler should acknowledge only after durable receipt when the provider’s retry contract depends on the response.
Test vectors should cover every supported key version.
Replay of Webhook Signature Verification should preserve original identifiers and timestamps so historical processing cannot masquerade as a new event.
For Webhook Signature Verification, the event identifier, signature result, delivery attempt, and resulting business state should remain connected throughout processing.
A receiver should treat transport acknowledgement and successful downstream processing as separate states for Webhook Signature Verification.
Key Takeaway
Signature verification authenticates covered bytes, while freshness, replay prevention, schema validation, and business authorization remain separate controls.
Sources
- NIST Documentation: Cryptographic Standards And Guidelines — NIST (2026-07-30)
- OxaPay Documentation: Webhook — OxaPay (2026-07-30)
- Stripe Documentation: Webhooks — Stripe (2026-07-30)