Verto signs every webhook payload so you can verify it genuinely came from Verto.
1. Each webhook request includes a Verto-Signature header containing an HMAC-SHA256 signature.
2. Verification steps 1. Retrieve raw request body. 2. Compute HMAC-SHA256 using your webhook signing secret. 3. Compare to the Verto-Signature header using a constant-time comparison.
💡 Tip: In Node.js: crypto.timingSafeEqual(). In Python: hmac.compare_digest(). |
3. Validate the Verto-Timestamp header is within +/-5 minutes of current time to protect against replay attacks.
⚠️ Warning: Reject payloads that fail signature verification or have timestamps outside the 5-minute window. |
Related articles: