Verify the Hookdeck Signature

Webhooks sent by Hookdeck are verified by calculating a digital signature. Each webhook request includes an X-Hookdeck-Signature header, generated using the workspace's secret along with the data sent in the request. To verify the request, compute the HMAC digest according to the following algorithm and compare it to the value in the X-Hookdeck-Signature header. If they match, the webhook was sent from Hookdeck.

Hookdeck signatures use a SHA-256 algorithm and are base64 encoded.

app.use(
  express.json({
    // Store the rawBody buffer on the request
    verify: (req, res, buf) => {
      req.rawBody = buf;
    },
  })
);

app.post('/webhook', async (req, res) => {
  //Extract X-Hookdeck-Signature Header from the request
  const hmacHeader = req.get('X-Hookdeck-Signature');

  //Create a hash based on the parsed body
  const hash = crypto.createHmac('sha256', secret).update(req.rawBody).digest('base64');

  // Compare the created hash with the value of the X-Hookdeck-Signature header
  if (hash === hmacHeader) {
    console.log('Webhook is originating from Hookdeck');
    res.sendStatus(200);
  } else {
    console.log('Signature is invalid, rejected');
    res.sendStatus(403);
  }
});