API Design · Middle · Question 39 of 75

How should a webhook receiver verify that a request really comes from the provider?

1Trust any request to the secret URL
✓Correct answer: Check an HMAC signature over the raw body and timestamp with a shared secret, and reject old timestamps
3Check the User-Agent header

Explanation

Compute the signature over the raw bytes (before JSON parsing) and compare in constant time. Standard Webhooks defines a common scheme.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.