Verifying DocWise webhook signatures
DocWise Team · · 3 min read
Every webhook delivery is signed. Here is how to verify the signature, reject replays and deduplicate events in a few lines of code.
Each delivery carries three headers: X-Webhook-Id (a stable event id), X-Webhook-Timestamp (Unix seconds) and X-Webhook-Signature (v1= followed by a hex HMAC-SHA256).
The signed message is the event id, the timestamp and the raw request body joined by dots. Compute it with your endpoint's secret and compare in constant time.
const expected = crypto
.createHmac("sha256", process.env.DOCWISE_WEBHOOK_SECRET)
.update(`${id}.${timestamp}.${rawBody}`)
.digest("hex");Replays and duplicates
Reject timestamps older than five minutes. Delivery is at least once, so store the event id and ignore ids you have already processed.
The quickstart in the API docs has complete Node.js and Python examples.