What is a webhook signature?
A webhook signature is a value the sender computes from the message and a shared secret, and sends in a header. The receiver recomputes it, and if the two match, the request came from the sender and was not changed on the way.
The problem it solves
A webhook is a request one system sends to a URL you own when something happens. Anyone who learns that URL can send requests to it. Without a check, your server cannot tell a real event from a forged one.
How it works
- When you create the endpoint, the sender gives you a secret that only the two of you know.
- For each delivery, the sender computes an HMAC, a keyed hash, of the message using that secret. ActiveQ uses HMAC-SHA256.
- The sender puts the result in a header.
- Your server computes the same HMAC over the body it received and compares the two values.
Someone without the secret cannot produce a matching value, and changing a single byte of the body changes the result.
Why there is a timestamp
A valid signed request that an attacker captured could be sent again later. To stop that, the timestamp is part of what is signed, and the receiver rejects deliveries that are too old. ActiveQ signs <timestamp>.<raw body> and asks you to reject anything more than 300 seconds from the current time.
Two details that cause most failures
- Use the raw body. If your framework parses and re-serialises the JSON, the bytes change and the signature will not match.
- Compare in constant time. A normal string comparison can leak how many leading characters matched.
A signature proves origin and integrity. It does not stop the same event arriving twice, so also ignore event ids you have already handled.
Next step
The full ActiveQ header format, Node and Python samples and rotation behaviour are in How to verify ActiveQ webhook signatures. The API and webhook overview is on the developers page, and the glossary has a short definition.
What the signature covers
The signature authenticates ActiveQ to you; protecting your own endpoint and secret storage is up to you. To connect ActiveQ to other apps, the guide to connecting Zapier, Make and n8n shows how.