HMAC — Verify a Webhook Signature Correctly
An HMAC combines a hash with a shared secret to produce a signature that proves both integrity and origin: only someone holding the secret could have generated it. It is what sits behind almost every webhook signature and signed API request you will implement.
When it helps
Because implementing verification is fiddly and the failure mode is dangerous. The signature must be computed over exactly the bytes that were sent — the raw body, before any parsing — and a framework that helpfully parses JSON before your handler sees it will produce a mismatch that looks like a wrong secret. Generating a signature yourself from a known payload and comparing gives you a fixed reference point to debug against.
Worth running automatically
Two things deserve continuous attention. The first is that verification must use a constant-time comparison; an ordinary string equality check leaks timing information that can be used to forge a signature, and it is a very easy mistake to make because it works perfectly in testing. The second is rotation: when a provider rotates a signing secret, every incoming webhook starts failing verification and your service looks healthy throughout. A scheduled check that posts a correctly signed payload and asserts it is accepted catches that within the hour.
What you get out of it
A reference implementation to debug against, and a prompt about the two mistakes — non-constant-time comparison and unmonitored secret rotation — that make webhook verification either insecure or silently broken.