Skip to main content
Leamout signs webhook deliveries with HMAC-SHA256. Each delivery includes these headers:
To verify a delivery:
  1. Read X-Leamout-Timestamp as the Unix timestamp Leamout used when signing.
  2. Keep the request body as the exact raw bytes received.
  3. Construct <timestamp>.<raw body>.
  4. Compute HMAC-SHA256 using the webhook endpoint’s signing secret.
  5. Hex-encode the digest and prefix it with v1=.
  6. Compare your value with X-Leamout-Signature using a constant-time comparison.
Verify the raw body before parsing or re-serializing JSON. Byte-level changes produce a different signature.
The webhook signing secret is returned when an endpoint is created or its secret is rotated. Store it as a secret and replace it when you rotate the endpoint secret.