Webhook Signature

All webhooks sent from Apara are signed with a dedicated secret that is known only by Apara and Customers. This ensures the integrity of the data contained in the webhook.

Note: Please connect with our tech support team to know your webhook dedicated secret key.

We are using HMAC (Hash-based Message Authentication Code) as the authentication method using two keys:

• HTTP Request Body
• Dedicated Secret Key

How Does Webhook Signature Work?

Use the code snippet below to generate the hash using dedicated_secret_key + request_body, then compare the generated hash with the signature received in the X-Apara-Hmac-Hash header.

1. Compute HMAC-SHA256 of the raw request body using your webhook secret
2. Compare against X-Apara-Hmac-Hash
3. If the generated hash matches, the webhook request is considered valid. If the values do not match, the request should be treated as invalid.

Always compute the hash over the raw request body. Re-serializing a parsed JSON object produces a different byte string and the signature will not match.

Node.js

const crypto = require('crypto');

function verifyWebhookSignature(req, dedicatedSecret) {
  const body = req.body.toString('utf8');
  const signature = req.headers['x-apara-hmac-hash'];

  const hash = crypto
    .createHmac('sha256', dedicatedSecret)
    .update(body)
    .digest('hex');

  return hash === signature;
}

Python

import hmac, hashlib

def verify_webhook_signature(raw_body, dedicated_secret, received_hash):
    computed = hmac.new(
        dedicated_secret.encode(),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(computed, received_hash)

Java

Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(dedicatedSecret.getBytes(), "HmacSHA256"));
String computed = HexFormat.of().formatHex(mac.doFinal(rawBody));
return MessageDigest.isEqual(computed.getBytes(), receivedHash.getBytes());