---
title: "Webhook Authentication"
source_url: https://docs.rapyd.net/en/webhook-authentication.html
lang: en
---

# Webhook Authentication

The `signature` header parameter for webhooks is calculated according to a specific formula.

You can verify the integrity of the webhook message by calculating the signature yourself and comparing it with the value you received in the webhook. If the values do not match, contact [Rapyd Client Support](https://support.rapyd.net).

Calculation of Signature

The signature is calculated as a hash of a concatenation of specific strings, according to the following formula:

**signature = BASE64 ( HASH ( url_path + salt + timestamp + access_key + secret_key + body_string ) )**

where:

- **BASE64** is a Base-64 encoding algorithm.
- **HASH** is HMAC-SHA256.
- **url_path** is the entire URL that was configured for your company to receive webhooks.

  See [Defining a Webhook Endpoint](https://docs.rapyd.net/en/defining-a-webhook-endpoint.md "Defining a Webhook Endpoint").
- **salt** is a unique random string for the webhook.
- **timestamp** is the time the webhook was sent, in [Unix time](https://docs.rapyd.net/en/glossary.md#UUID-945d98cf-adae-e1cf-2606-c7fae8b4a7e1_unix_time "Unix time") (seconds). The Rapyd platform is synchronized to the actual current time, as defined by public [NTP](https://docs.rapyd.net/en/glossary.md#UUID-945d98cf-adae-e1cf-2606-c7fae8b4a7e1_ntp "Network Time Protocol") servers.
- **access_key** is the access key for your organization, assigned by Rapyd or the merchant's account owner.

  This value is available to the account owner in production, and to all users in the sandbox. Use the Client Portal. See [Developers](https://docs.rapyd.net/en/developers.md "Developers").
- **secret_key** is the secret key for your organization, assigned by Rapyd or the merchant's account owner.

  This value is available to the account owner in production, and to all users in the sandbox. Use the Client Portal.. See [Developers](https://docs.rapyd.net/en/developers.md "Developers").

  > **Warning:**
  >
  > The secret key is like a password, and is transmitted only as part of the calculated signature. Do not share it with your customers or partners, and do not transmit it in plaintext.
- **body_string** is a valid JSON string. The body of a webhook does not contain any whitespace other than inside a string. If your tools present the webhook as pretty-printed, you must remove the whitespace (spaces, tabs, newlines) before calculating the signature.

> **Note:**
>
> Different languages handle Base-64 encoding differently. You must adequately test your code so that you are using all the correct Base-64 options to validate the signatures that Rapyd sends.

Related Information

- [Authentication](https://docs.rapyd.net/en/authentication.md "Authentication") - Describes the formula for calculating signatures for requests to the Rapyd platform. Provides code examples.