Verifying signatures

Every request is signed with the webhook's signing secret, so your endpoint can confirm a delivery came from Imploy. To verify a delivery:

1. Read the raw request body, without changing it.
2. Build the string event_id + "." + timestamp + "." + body, using the values of X-Imploy-Event-Id, X-Imploy-Timestamp and the body.
3. Compute an HMAC-SHA256 of that string with your signing secret.
4. Compare the result, as hex, with the value after sha256= in X-Imploy-Signature.

expected = "sha256=" + hmac_sha256_hex(secret, event_id + "." + timestamp + "." + raw_body)
valid    = constant_equals(expected, header("X-Imploy-Signature"))

You can reveal or rotate the signing secret on the webhook. Rotating changes what your endpoint must use straight away. See Managing webhooks.