Signature Verification

Verify webhook authenticity with HMAC-SHA256.

Signature Model

All webhooks include a signature computed using HMAC-SHA256 over the timestamp and raw request body.

Headers:

X-ThreeU-Signature: sha256=<hmac_hash>
X-ThreeU-Timestamp: 1710000000
X-Brand-ID: 123

Signed payload:

signed_payload = timestamp + "." + raw_body
signature = HMAC-SHA256(webhook_secret, signed_payload)