Webhooks and events Required

Sign every webhook

Sign each webhook body with a secret shared with the receiver, and include a timestamp, so receivers can reject fakes and replays.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Send an HMAC-SHA256 of the message ID, timestamp and raw body in a header. Receivers compare it in constant time, as in constant-time compare, and reject messages older than a few minutes. The Standard Webhooks specification describes one common format.

Example

POST /hooks/example-shop HTTP/1.1
Webhook-Id: msg_2kQ8
Webhook-Timestamp: 1793518800
Webhook-Signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=
Content-Type: application/json

{"type":"order.shipped","data":{"orderId":"ord_8f2k"}}

How to check

Send a test webhook with one byte of the body changed. The receiver rejects it with 401, and an old timestamp is rejected too.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/webhooks-and-events/signed-webhooks.