Verify a webhook signature.

Check a webhook’s HMAC-SHA256 signature against its raw payload and signing secret to identify mismatches before trusting the event.

The endpoint anyone can call

Webhooks are how the services you use tell your app that something happened — a payment cleared, a build finished, a user signed up. The catch is that the endpoint is a public URL, so without verification anyone who finds it can send fake events and your app will dutifully act on them. The signature closes that hole: the sender hashes the payload with a shared secret, you recompute the hash, and if they match the event is genuine. It’s a few lines of code and the difference between trusting your webhooks and being spoofed by them.

Verifying signatures is the per-endpoint version of a bigger principle: don’t trust input, verify it — and keep the secrets that make verification possible somewhere controlled. Managing those signing secrets and proving how inbound events are authenticated, across the backend you own, is part of what a control plane keeps honest.