What is HMAC Signature Verification?
Recomputing a hash-based signature over the raw webhook body with a shared secret and comparing in constant time. HMAC verification is the proof a callback came from the provider, not an impersonator.
Example
A Paddle notification route reads the raw body, recomputes the HMAC with the webhook secret, and fulfills the subscription only on match; mismatches log and return 400 without touching orders.
What people get wrong
Parsing the body to JSON first or comparing signatures with early-exit equality. Parse transforms bytes and timing leaks match length; verify raw bytes in constant time.
Frequently asked questions
Why verify the raw body?
Serialization reformats bytes, which breaks signatures. Hash exactly the bytes received, then compare against the provider header.
What belongs in the comparison?
Constant-time equality over hex or base64 digests. Early-exit string comparison leaks match position through timing side channels.
Related terms
Webhook Verification
Cryptographically confirming payment callbacks actually came from the provider before fulfilling orders. Unverified webhooks let anyone grant themselves premium.
Timestamp Tolerance
Rejecting signed webhooks whose timestamps fall outside a narrow window, typically minutes. Tolerance windows shrink replay-attack surface: even a valid captured payload expires before attackers can reuse it.
Payment Orchestration
The cross-provider setup order: products, prices, client tokens, notifications, checkout, webhooks — with clear env ownership per step. Orchestration prevents half-wired billing that charges nobody or everyone.
REST Resource Design
Modeling an API as nouns with stable URLs — /projects/:id/messages — instead of action endpoints. Resource design makes caching, auth scoping, and client reasoning predictable across every route.
Idempotent HTTP Verbs
GET, PUT, and DELETE produce the same result when safely retried; POST does not promise that. BYOB server routes use idempotent verbs for mutations clients may repeat after network timeouts.
Retry, Backoff & Jitter
Retrying failed calls after growing delays with random spread, so a fleet does not stampede a recovering service. Exponential backoff plus jitter turns synchronized thundering herds into gentle background noise.