Verify Webhook Authenticity with HMAC
Configure HMAC signature verification on a webhook event source
Webhook event sources support HMAC-SHA256 signature verification. When a webhook secret is configured, Bifrost rejects any inbound request whose signature header doesn’t match a digest of the request body.
Configure HMAC Verification
Section titled “Configure HMAC Verification”-
Open the webhook event source and scroll to the Authentication section.
-
Set the shared Webhook Secret, the Signature Header name (e.g.
X-Hub-Signature-256), and a Signature Prefix if your provider uses one (e.g.sha256=). -
Save. Subsequent inbound requests must carry a valid HMAC signature in the configured header, or they are rejected with
401.
| Field | Description | Example |
|---|---|---|
| Webhook Secret | Shared secret used as the HMAC key | whsec_abc123... |
| Signature Header | Header carrying the signature | X-Hub-Signature-256 |
| Signature Prefix | Stripped before comparison | sha256= |
| Event Type Header | Header carrying the event type (optional) | X-Event-Type |
| Event Type Field | Body field carrying the event type (optional) | event |
Next Steps
Section titled “Next Steps”- Create Subscriptions — route verified events to workflows or agents.
- Webhook & Event Variables — payload field reference.