Skip to content
Authometry Dashboard

Operate

Webhook verification

Verify signed audit-event deliveries and apply side effects exactly once.

Verify before parsing

Read the raw request body. Compute HMAC-SHA-256 over the timestamp, a period, and those exact bytes. Compare the hexadecimal digest with x-authometry-signature in constant time.

signed = x-authometry-timestamp + '.' + rawBody
expected = HMAC_SHA256(webhookSecret, signed)
received = x-authometry-signature.replace('v1=', '')

Reject unsafe deliveries

  • Reject timestamps outside a short tolerance to limit replay.
  • Deduplicate x-authometry-delivery before applying side effects.
  • Return a 2xx only after the event is durably accepted.
  • Rotate by creating a new secret, updating the consumer, then retiring the old subscription.

Delivery behavior

Authometry sends HTTPS POST requests with a ten-second timeout. Failed deliveries use exponential retry delays and retain bounded response details for diagnostics. Destinations resolving to private or reserved addresses are rejected.