whsec_…). Verify before you trust the payload.
Contract
Do not re-serialize JSON before verifying. A
null or missing body is treated as empty bytes in the official helpers.
Event catalog: Webhooks.
Python
Node.js
Go
PHP
Ruby
Java
.NET
Checklist
- Read the raw body bytes from the HTTP request.
- Read
X-Praxicraft-Signature. - Call the SDK helper with your stored
whsec_…. - Reject the request if verification fails.
- Parse JSON only after a successful verify.
- Deduplicate with delivery
id/event_id.