Signature Verification

Header format

Every webhook delivery includes a signature header:

X-Ledger-Signature: t=<unix_seconds>,v1=<hex_hmac_sha256>

Verification steps

Extract the timestamp and signature

Parse the t (timestamp) and v1 (signature) values from the header.

Compute the expected signature

const crypto = require('crypto');

const payload = `${timestamp}.${rawBody}`;
const expected = crypto
  .createHmac('sha256', signingSecret)
  .update(payload)
  .digest('hex');

Compare signatures

Use a constant-time comparison to check that your computed signature matches v1.

const isValid = crypto.timingSafeEqual(
  Buffer.from(expected, 'hex'),
  Buffer.from(v1, 'hex')
);

Replay protection

Optionally check that t is within an acceptable window (e.g. 5 minutes) to prevent replay attacks.

Get Started

Core Concepts

Guides

Webhooks

Signature Verification

Header format

Verification steps

Replay protection

​Header format

​Verification steps

​Replay protection

Header format

Verification steps

Replay protection