Security & Signature Verification

All webhook requests include a buzzin-signature header containing an HMAC SHA-256 signature and a buzzin-signature-timestamp header containing the timestamp used in signature generation. You must verify this signature to ensure the request is authentic.

Signature Generation

The signature is generated using:

Algorithm: HMAC SHA-256

Secret: Your webhook secret key

Payload: The raw JSON body of the request

Timestamp: Unix timestamp in milliseconds (included in buzzin-signature-timestamp header)

Signature Format: HMAC-SHA256(secret, timestamp + "-" + payload)

The signature is computed by concatenating the timestamp and payload with a hyphen separator: ${timestamp}-${payload}

Verification Process

Extract the buzzin-signature and buzzin-signature-timestamp headers from the request

Compute the HMAC SHA-256 signature of ${timestamp}-${payload} using your secret

Compare the computed signature with the provided signature

Optionally verify the timestamp is recent (within 5 minutes) to prevent replay attacks

Reject the request if signatures don't match or timestamp is too old

Signature Generation#

Verification Process#

Signature Generation

Verification Process