Skip to content
Go to dashboard

11.4Verify a webhook came from obsrvly

When the channel has an HMAC signing secret, each request carries this header:

X-Obsrvly-Signature: sha256=<hex>

<hex> is the HMAC-SHA256 signature: a code made from the request body and your secret. It is written in lowercase hexadecimal. You make the same code on your side and compare.

  1. Read the raw body: the exact bytes you received, before any JSON parsing.
  2. Compute HMAC-SHA256 of the raw body. Use your signing secret as the key.
  3. Write the result in hexadecimal.
  4. Compare it with the part after sha256=. Use a constant-time comparison: one that takes the same time whether or not the values match.
  5. If they differ, or the header is missing, reply 401 and stop.
  6. Only then parse the JSON.
  • If the channel has no secret, the header is not sent. If you rely on the check, reject requests without it.
  • The signature covers the body only. No timestamp is sent.
  • fired_at and resolved_at describe the event, not the time of sending. A reminder or a retry can carry an older fired_at.
  • A header you added, such as Authorization: Bearer …, is an extra check you can make on your side.

Change the secret#

Change the secret in the channel editor and select save channel, or send a new webhookSecret with UpdateAlertChannel. New requests use the new secret at once. A channel has only one secret.

Last updated