Signed Webhook
Definition
A signed webhook allows verification of the origin and integrity of a transmitted message.
A webhook whose sender cryptographically signs or authenticates the message so that the recipient can verify origin and integrity.
Simply explained
The message carries a digital seal that allows the recipient to verify sender and possible alterations.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
The recipient verifies HMAC over the unchanged request body, timestamp, and event ID.
Limits and pitfalls
- Modifying the body before verification, hardcoding keys, forgetting replay protection or constant-time comparison.
Origin & history
Signed webhooks have become a common security measure with API integrations and event-driven services.
Use in mid-sized companies
- Possible application: The recipient verifies HMAC over the unchanged request body, timestamp, and event ID.
Frequently asked questions
What does signed webhook mean?
A webhook whose sender cryptographically signs or authenticates the message so that the recipient can verify origin and integrity. What mistakes should be avoided? Modifying the body before verification, hardcoding keys, forgetting replay protection or constant-time comparison.
Sources
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: