What is Webhook Signature?

A webhook is a request that another service sends to your app when something happens, for example when a payment succeeds. The endpoint that receives it must be public, which means anyone who finds the URL can send a fake event. Without a check, an attacker can post a made-up payment succeeded message and unlock a paid plan for free.

The signature prevents that. The provider computes a hash of the request body using a secret that only the two of you know, and sends it in a header: Stripe-Signature for Stripe, X-Hub-Signature-256 for GitHub. Your code recomputes the hash and compares. Stripe's documentation notes that verification needs the raw request body, so a framework that parses the JSON first will break it. GitHub's documentation recommends a constant-time comparison rather than a plain equality check.

AI-generated webhook handlers often skip verification entirely, or parse the body before verifying and then disable the check when it fails. Use the provider's official library, pass it the raw body, keep the signing secret in an environment variable, and reject any request that fails with a 400 response before doing any work.