Verifying webhook signatures

What this does

Verify the SmartQ signature against the raw request body before trusting a webhook delivery.

Steps

1. Read the signing algorithm and header names from the current Developer Portal reference.
2. Capture the request's raw bytes before JSON parsing.
3. Compute the expected signature using the stored webhook secret.
4. Compare signatures with a timing-safe operation.
5. Reject invalid or stale deliveries and protect against replay.

What happens next

Your change is available within the scope you selected.

Warnings

• Do not paste a signing secret into Support.