​

Webhook Security

​

How Signature Verification Works

​

1. Get Your Signing Secret

​

2. Verify the Signature

​

Using Node.js SDK

try {
 // Returns true if valid, throws fypeSignatureVerificationError if invalid
 fype.webhooks.verifySignature(
 rawBody,
 headers['x-fype-signature'],
 process.env.FYPE_WEBHOOK_SECRET
 );
 // Proceed with business logic
} catch (err) {
 // Handle invalid signature
 console.error("Invalid signature:", err.message);
}

​

Using Python SDK

try:
 # Returns True if valid, raises SignatureVerificationError if invalid
 is_valid = fype.webhooks.verify_signature(
 raw_payload=request.body(),
 signature_header=request.headers.get('X-fype-Signature'),
 secret=os.getenv("FYPE_WEBHOOK_SECRET")
 )
except SignatureVerificationError:
 # Handle invalid signature
 pass

​

Manual Verification (If not using SDKs)

1. Extract the raw body: Get the raw, unparsed JSON body of the request. Do not use a parsed JSON object, as whitespace differences will cause verification to fail.
2. Generate the HMAC: Use the SHA256 hashing algorithm and your whsec_ secret as the key.
3. Compare: Generate the hex digest of the HMAC. Compare it to the value in the X-fype-Signature header using a constant-time string comparison function to prevent timing attacks.

​

Best Practices

• Never Hardcode Secrets: Store your whsec_ secrets in secure environment variables.
• Verify before Processing: Perform the signature check before executing any business logic or database updates.
• Use HTTPS: Always use an https:// URL for your webhook endpoints to ensure data is encrypted in transit.
• IP Whitelisting: While signature verification is sufficient, you may also choose to whitelist fype’s outgoing IP addresses (contact support for the latest list).