How do I verify webhook signatures, and where is the signing secret?

Every webhook is signed so you can confirm it came from Baselayer and was not altered in transit. Verification is straightforward:

1. Add your endpoint under the Webhooks tab in the console. The signing secret appears next to it once created, and each endpoint has its own secret.

2. On each delivery, compute an HMAC-SHA256 over the payload using the secret and compare it to the signature header.

3. Reject payloads whose signature does not match.

For further details about webhooks in Baselayer read our available guide: https://docs.baselayer.com/docs/webhooks-at-baselayer

Baselayer webhooks are delivered through Svix, so Svix’s verification guide applies exactly, including the header names and the timestamp check that protects against replay: Svix payload verification. Svix also publishes verification libraries for most languages if you would rather not implement it by hand.

Channels, which let one endpoint receive only a subset of events, are also a Svix feature: Svix channels. You do not need to create channels before registering an endpoint; subscribe the endpoint to the event types you want.