Webhook events fired by Truss.

Verifying signatures

When your subscription has a signing secret, every delivery includes an X-Webhook-Signature header so you can confirm the request came from Truss and was not modified in transit.

The header has the format t=<timestamp>,v1=<signature>, where timestamp is the Unix time the request was signed and signature is a hex-encoded HMAC-SHA256.

To verify a delivery:

1. Parse the t and v1 values from the header.
2. Compute the HMAC-SHA256 of the string <timestamp>.<raw_request_body> using your signing secret as the key. Sign the raw request body exactly as received — do not parse and re-serialize the JSON, or the signature will not match.
3. Compare your result to v1 using a constant-time comparison.
4. Reject the delivery if the signature does not match, or if timestamp is more than 5 minutes old (replay protection).