signature with the full raw payload

Not specified by the original author.

TL;DR

Use the secret shown for that form as the key, base64 the digest, and compare with the header using a constant-time compare. When you verify Typeform webhook signatures, hash the raw request body bytes, not the parsed JSON; re-serializing changes whitespace and breaks the HMAC.

Steps

1. Use the secret shown for that form as the key, base64 the digest, and compare with the header using a constant-time compare.
2. When you verify Typeform webhook signatures, hash the raw request body bytes, not the parsed JSON; re-serializing changes whitespace and breaks the HMAC.

When to use

You are seeing this: The working approach: take the entire received payload as binary, HMAC-SHA256 it with the form's secret token as key, base64-encode, and compare against the signature header. Use this skill when you run into "Typeform webhooks: verify the HMAC signature with the full raw payload".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #59114066 (accepted answer, 5 votes): the asker's webhook signature checks never matched. The working approach: take the entire received payload as binary, HMAC-SHA256 it with the form's secret token as key, base64-encode, and compare against the signature header.

Verified resolution: When you verify Typeform webhook signatures, hash the raw request body bytes, not the parsed JSON; re-serializing changes whitespace and breaks the HMAC. Use the secret shown for that form as the key, base64 the digest, and compare with the header using a constant-time compare.

Source URL: https://stackoverflow.com/questions/59114066/securing-typeform-webhook-python

Not specified by the original author.

Verify against the raw request body bytes: capture the body before any JSON parsing (in Next.js disable body parsing for the route, in Express use the raw-body middleware). Split the WorkOS-Signature header on the comma into t= and v1=, reject timestamps older than your tolerance (default a few minutes, in milliseconds) to block replays, then HMAC-SHA256 the string timestamp + '.' + rawBody with the webhook secret and compare hex digests with a timing-safe compare. For local testing register an ngrok public URL, not YOUR_HOST, since WorkOS rejects non-public hostnames at save time.

Context: Official docs (Sync data with webhooks): documents a gotcha that trips agents verifying WorkOS webhook signatures. The WorkOS-Signature header carries t=[milliseconds], v1=[hmac], and the signature is HMAC-SHA256 hex over the concatenation of the timestamp, a dot, and the request body as a utf-8 string. Agents that parse the body to JSON first and re-stringify it compute the HMAC over different bytes and fail verification on every delivery. The docs also note the endpoint URL must resolve to a public IP; WorkOS rejects private or internal hostnames when you save the endpoint.

Matched source

Source: Published skill Original query: "WorkOS webhook signatures need the raw body, not parsed JSON" Key terms: body, json, need, parsed, signatures, webhook, workos

Source: Official docs (Sync data with webhooks): documents a gotcha that trips agents verifying WorkOS webhook signatures. The WorkOS-Signature header carries t=[milliseconds], v1=[hmac], and the signature is HMAC-SHA256 hex over the concatenation of the timestamp, a dot, and the request body as a utf-8 string. Agents that parse the body to JSON first and re-stringify it compute the HMAC over different bytes and fail verification on every delivery. The docs also note the endpoint URL must resolve to a public IP; WorkOS rejects private or internal hostnames when you save the endpoint.

Verified resolution: Verify against the raw request body bytes: capture the body before any JSON parsing (in Next.js disable body parsing for the route, in Express use the raw-body middleware). Split the WorkOS-Signature header on the comma into t= and v1=, reject timestamps older than your tolerance (default a few minutes, in milliseconds) to block replays, then HMAC-SHA256 the string timestamp + '.' + rawBody with the webhook secret and compare hex digests with a timing-safe compare. For local testing register an ngrok public URL, not YOUR_HOST, since WorkOS rejects non-public hostnames at save time.

Source URL: https://workos.com/docs/events/data-syncing/webhooks

Not specified by the original author.

TL;DR

Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.

The query

zendesk webhook signature verification failed

Use this when

• Your endpoint rejects Zendesk webhook events on signature
• Signature fails for some events but not others
• Verification passes in local tests but fails in production

Not for

• Webhook events never reaching your endpoint
• 401 errors calling the Zendesk API
• Target URL connection or timeout errors

Steps

1. Use the raw body, not the parsed JSON

Grab the body before your framework parses it. In Express that means the raw-body middleware; in other stacks, read the bytes directly. Re-serializing parsed JSON changes whitespace and key order, which changes the hash.

Expected output: the byte string your handler hashes, identical to what arrived on the wire.

2. Confirm the signing secret matches the webhook

Copy the signing secret from the Zendesk webhook configuration, not from docs or memory. Each webhook has its own secret; using another webhook's secret fails every time. Check for pasted whitespace.

Expected output: a test event verifying successfully with the copied secret.

3. Compute HMAC-SHA256 exactly like Zendesk

Hash the raw bytes with the secret using HMAC-SHA256, then compare against the signature header value. Use a constant-time comparison; a plain string compare is fine functionally but leaks timing. Mind hex vs base64 encoding of the digest.

Expected output: your computed digest matching the header for a known event.

4. Check for body-mutating middleware in production

If local tests pass and production fails, something between Zendesk and your handler is rewriting the body: a WAF, a proxy that normalizes JSON, or a logging middleware. Compare the Content-Length header against the bytes you received.

Expected output: identical byte counts at the edge and in your handler.

Variant phrasings

zendesk webhook hmac signature invalid

Steps 1 through 3 cover the full verification recipe.

zendesk signatures fail after moving to a new server

Step 4. New infra almost always adds a proxy that touches the body.

Why it happens

Zendesk signs the bytes on the wire, so anything that changes those bytes after signing invalidates the signature. Local tests pass because nothing sits between the test sender and the handler. Production inserts proxies, WAFs, and framework middleware, and one of them usually 'helpfully' reformats the JSON.

Edge cases

• Secret rotation: Zendesk lets you rotate the signing secret. During rotation, accept both old and new for a window.
• Replayed events: signatures don't expire. Add your own timestamp check if replay matters to you.
• Multiple webhooks to one endpoint: each has its own secret. Route by webhook id before verifying.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Thread query: zendesk webhook signature verification failed

TL;DR: Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.