Skip to main content
Assess signs outbound webhook bodies with your endpoint secret (whsec_…). Verify before you trust the payload.

Contract

Do not re-serialize JSON before verifying. A null or missing body is treated as empty bytes in the official helpers. Event catalog: Webhooks.

Python

Node.js

Go

PHP

Ruby

Java

.NET

Checklist

  1. Read the raw body bytes from the HTTP request.
  2. Read X-Praxicraft-Signature.
  3. Call the SDK helper with your stored whsec_….
  4. Reject the request if verification fails.
  5. Parse JSON only after a successful verify.
  6. Deduplicate with delivery id / event_id.

Next

Webhooks guide · n8n trigger (verifies signatures for you)
Last modified on August 21, 2026