JSON HMAC Verifier

What is HMAC?

HMAC (Hash-based Message Authentication Code) is a mechanism for verifying the integrity and authenticity of a message using a shared secret key. Webhook providers use it to prove that a payload genuinely came from them.

# Node.js example
const crypto = require('crypto');
const secret = 'my-webhook-secret';
const payload = JSON.stringify(body);
const sig = crypto.createHmac('sha256', secret).update(payload).digest('hex');
// GitHub sends: X-Hub-Signature-256: sha256=<sig>

Verifying a Webhook in Python

import hmac, hashlib, json

def verify_webhook(payload: dict, secret: str, received_sig: str) -> bool:
    body = json.dumps(payload, separators=(',', ':'))
    expected = hmac.new(
        secret.encode(), body.encode(), hashlib.sha256
    ).hexdigest()
    # Strip provider prefix if present (e.g. "sha256=")
    clean = received_sig.split('=', 1)[-1]
    return hmac.compare_digest(expected, clean)

Common Use Cases

• GitHub Webhooks: Verify X-Hub-Signature-256 headers on push/PR events
• Stripe Webhooks: Validate payment event payloads with Stripe-Signature
• Shopify: Authenticate order and fulfillment webhook calls
• Slack Events API: Confirm requests originate from Slack
• Custom APIs: Add HMAC signing to your own webhook integrations

FAQ