System Design · Senior · Question 34 of 75

How do you verify the authenticity of an incoming webhook?

Explanation

The webhook endpoint is public; anyone can call it. The provider signs the body with a secret, and you verify the signature (on the raw body) and the time to reject replays. Everything else is easy to forge.

Further reading

Problem with a question

System Design · Senior · question 34

Test yourself

Take the System Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.

Take this quiz