Webhook security
To ensure the integrity of the webhooks you receive, we recommend verifying the signatures of the webhooks you receive. The webhook platform we use, Svix, provides packages for multiple languages that make verifying signatures easy.
First, obtain your webhook secret on the configuration page for your webhook under the Signing Secret:
Then, to verify the webhook, pass your signing secret with the headers and raw payload body to the verify method.
Make sure to use the raw request body for the payload
If your framework parses JSON, you’ll want to use the raw request body instead of the parsed JSON.
To view more information on how to verify signatures, and to see examples for popular frameworks, visit Svix’s documentation.
If you want to verify webhooks manually, follow this guide.