Security

HMAC-SHA256 Signature Verification

Every webhook includes a cryptographic signature computed with HMAC-SHA256. This proves the webhook came from HookSniff and wasn't tampered with.

HookSniff follows the Standard Webhooks specification — the same standard used by Svix, Clerk, and other webhook providers.

Headers

Each delivery includes three headers:

Algorithm

signed_content = "{webhook-id}.{webhook-timestamp}.{body}"
signature = "v1," + base64(hmac_sha256(secret, signed_content))

Verify with SDKs

All HookSniff SDKs handle verification automatically:

// Node.js
import { Webhook } from 'hooksniff';
const wh = new Webhook('whsec_your_secret');
const payload = wh.verify(req.body, {
  'webhook-id': req.headers['webhook-id'],
  'webhook-timestamp': req.headers['webhook-timestamp'],
  'webhook-signature': req.headers['webhook-signature'],
});

# Python
from hooksniff import Webhook
wh = Webhook("whsec_your_secret")
payload = wh.verify(request.data, dict(request.headers))

// Go
wh, _ := hooksniff.NewWebhook("whsec_your_secret")
payload, err := wh.Verify(r.Body, r.Header)

See Webhook Verification Guide for all 11 languages.

SSRF Protection

HookSniff blocks webhook delivery to private/internal IP addresses to prevent Server-Side Request Forgery (SSRF) attacks.

TLS Enforcement

All webhook deliveries use HTTPS. HookSniff refuses to deliver to HTTP endpoints (except localhost for development).

• TLS 1.2+ required
• Certificate validation enforced
• HTTP endpoints rejected with endpoint_url_not_https error

Two-Factor Authentication (2FA)

Protect your HookSniff account with TOTP-based 2FA:

# Enable 2FA
curl -X POST https://hooksniff-api-1046140057667.europe-west1.run.app/v1/auth/2fa/enable \
  -H "Authorization: Bearer hr_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password": "your_password"}'

# Returns QR code URL for your authenticator app

API Key Security