Webhook Verification

This guide explains how to verify the authenticity and integrity of incoming webhook requests sent by Datman using HMAC SHA-256. This ensures that the request genuinely comes from Datman and has not been altered in transit.

Prerequisites

Before implementing signature verification, ensure you have the following:

The shared WEBHOOK_SECRET_KEY provided by Datman.

Access to the raw request body of the webhook as a string.

The incoming hmacsignature header, which contains the expected HMAC hash.

What You Receive from Datman

Each webhook request will include:

The request body (usually a JSON payload).

An HTTP header:

How Signature Verification Works

To verify a webhook sent by Datman:

Extract the raw request body.

Generate a new HMAC SHA-256 hash using:

The raw request body (unparsed).

The shared WEBHOOK_SECRET_KEY.

Base64-encode the hash.

Compare your generated signature with the hmacsignature header from the request.

If both values match, the request is authentic.

Sample Implementations

JavaScript

Python

PHP

Prerequisites#

What You Receive from Datman#

How Signature Verification Works#

Sample Implementations#

Prerequisites

What You Receive from Datman

How Signature Verification Works

Sample Implementations