Verify webhook signatures

Verify before parsing

Your public HTTPS endpoint receives the three headers below. Use the endpoint signing secret to compute HMAC-SHA256 over:

<eventId>.<timestamp>.<exact UTF-8 request bytes>

Skinloop-Timestamp is the current Unix timestamp in seconds, encoded as a decimal string. Compare the lowercase hexadecimal digest with Skinloop-Signature: v1=... using a constant-time comparison:

import { createHmac, timingSafeEqual } from "node:crypto";

function validSignature(rawBody: Buffer, eventId: string, timestamp: string,
  signature: string, secret: string) {
  const message = Buffer.concat([
    Buffer.from(eventId, "utf8"),
    Buffer.from(".", "utf8"),
    Buffer.from(timestamp, "utf8"),
    Buffer.from(".", "utf8"),
    rawBody
  ]);
  const expected = createHmac("sha256", secret).update(message).digest("hex");
  const received = signature.startsWith("v1=") ? signature.slice(3) : "";
  return received.length === expected.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(expected));
}

Use the timestamp to enforce a freshness window configured by your receiver. Reject malformed headers, stale timestamps, unknown secrets, and altered bodies. Read the request body as raw bytes first; never parse and reserialize it before verification. Store the event ID only after authentication. Next: return 2xx after durable storage and deduplicate using the stable event ID. See retries.

Getting started

Hosted checkout

Payments and payouts

Integration reliability

API reference

Verify webhook signatures

Verify before parsing

​Verify before parsing

Verify before parsing