Verifying Incoming Webhooks

Incoming webhooks require signature verification over the exact raw body before parsing or applying changes.

What It Does

Incoming webhooks require signature verification over the exact raw body before parsing or applying changes. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

A provider signing secret or verification key, the unmodified HTTP request body and durable event deduplication.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Understand the primary operation and its inputs.

<?php
$body = '{"event":"paid","id":"e7"}';
$secret = 'test-only-secret';
$header = hash_hmac('sha256', $body, $secret);
var_dump(hash_equals(hash_hmac('sha256', $body, $secret), $header));

Example 2: Another Case

Check failure behavior or a different execution path.

<?php
$age = abs(time() - (time() - 20));
var_dump($age <= 300); // Reject messages outside the timestamp window

Practical Example: Putting It to Use

Apply the behavior in a small, controlled scenario.

<?php
$ids = ['evt-10', 'evt-10', 'evt-11'];
$processed = [];
foreach ($ids as $id) { if (isset($processed[$id])) continue; $processed[$id] = true; }
echo count($processed); // Production needs an atomic unique constraint

Important Behavior and Edge Cases

A correct HMAC alone does not stop replayed messages; validate time windows and deduplicate event IDs.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Incoming webhooks require signature verification over the exact raw body before parsing or applying changes.
• A correct HMAC alone does not stop replayed messages; validate time windows and deduplicate event IDs.
• Use constant-time comparison and durable idempotency records.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.