Verify HMAC Signature with HTTP / Webhook API

Pipedream makes it easy to connect APIs for HTTP / Webhook and 2,800+ other apps remarkably fast.

Trigger workflow on

HTTP requests, schedules and app events

Next, do this

Verify HMAC Signature with the HTTP / Webhook API

No credit card required

▶

Watch us build a workflow

8 min

Watch now ➜

Trusted by 1,000,000+ developers from startups to Fortune 500 companies

Developers ♥ Pipedream

Getting Started#

Create a workflow to Verify HMAC Signature with the HTTP / Webhook API. When you configure and deploy the workflow, it will run on Pipedream's servers 24x7 for free.

Configure the Verify HMAC Signature action
1. Connect your HTTP / Webhook account
2. Configure Secret
3. Configure Signature
4. Configure Raw Body
5. Configure Return Error to Webhook Caller
Select a trigger to run your workflow on HTTP requests, schedules or app events
Deploy the workflow
Send a test event to validate your setup
Turn on the trigger

Integrations#

Verify HMAC Signature with HTTP / Webhook API on New Requests (Payload Only) from HTTP / Webhook API

HTTP / Webhook + HTTP / Webhook

Try it

Verify HMAC Signature with HTTP / Webhook API on New Submission from Typeform API

Typeform + HTTP / Webhook

Try it

Verify HMAC Signature with HTTP / Webhook API on New Submission (Instant) from Jotform API

Jotform + HTTP / Webhook

Try it

Verify HMAC Signature with HTTP / Webhook API on New Scheduled Tasks from Pipedream API

Pipedream + HTTP / Webhook

Try it

Verify HMAC Signature with HTTP / Webhook API on New Download Counts from npm API

npm + HTTP / Webhook

Try it

Details#

This is a pre-built, source-available component from Pipedream's GitHub repo. The component is developed by Pipedream and the community, and verified and maintained by Pipedream.

To contribute an update to an existing component or create a new component, create a PR on GitHub. If you're new to Pipedream component development, you can start with quickstarts for trigger span and action development, and then review the component API reference.

Verify HMAC Signature on HTTP / Webhook

Description:Validate HMAC signature for incoming HTTP webhook requests. Make sure to configure the HTTP trigger to "Return a custom response from your workflow".

Version:0.0.2

Key:http-verify-hmac-signature

View on GitHub

Code#

import crypto from "crypto";
import http from "../../http.app.mjs";

export default {
  name: "Verify HMAC Signature",
  version: "0.0.2",
  key: "http-verify-hmac-signature",
  description: "Validate HMAC signature for incoming HTTP webhook requests. Make sure to configure the HTTP trigger to \"Return a custom response from your workflow\".",
  type: "action",
  props: {
    http,
    secret: {
      type: "string",
      label: "Secret",
      description: "Your secret key used for validation",
      secret: true,
    },
    signature: {
      type: "string",
      label: "Signature",
      description: "The HMAC signature received from the incoming webhook, typically provided in a specific HTTP header",
    },
    bodyRaw: {
      type: "string",
      label: "Raw Body",
      description: "The raw request body received from the webhook caller, provided as a string without any parsing or modifications",
    },
    customResponse: {
      type: "boolean",
      label: "Return Error to Webhook Caller",
      description: "If `True`, returns a `401: Invalid credentials` error in the case of invalid authorization. **Make sure to configure the HTTP trigger to \"Return a custom response from your workflow\"**. If `False`, does not return a custom response in the case of invalid auth.",
      default: true,
    },
  },
  methods: {
    _checkHmac(secret, signature, bodyRaw) {
      const expectedSignature = crypto
        .createHmac("sha256", secret)
        .update(bodyRaw, "utf8")
        .digest();

      const signatureBuffer = Buffer.from(signature, "hex");
      if (signatureBuffer.length !== expectedSignature.length) {
        return false;
      }
      return crypto.timingSafeEqual(signatureBuffer, expectedSignature);
    },
  },
  async run({ $ }) {
    const valid = this._checkHmac(
      this.secret,
      this.signature,
      this.bodyRaw,
    );

    if (!valid) {
      if (this.customResponse) {
        await $.respond({
          status: 401,
          headers: {},
          body: "Invalid credentials",
        });
      }
      if ($.flow) {
        return $.flow.exit("Invalid credentials");
      } else {
        throw new Error("Invalid credentials");
      }
    }

    $.export("$summary", "HTTP request successfully authenticated");
  },
};

Configuration#

This component may be configured based on the props defined in the component code. Pipedream automatically prompts for input values in the UI and CLI.

Label	Prop	Type	Description
HTTP / Webhook	`http`	`app`	This component uses the HTTP / Webhook app.
Secret	`secret`	`string`	Your secret key used for validation
Signature	`signature`	`string`	The HMAC signature received from the incoming webhook, typically provided in a specific HTTP header
Raw Body	`bodyRaw`	`string`	The raw request body received from the webhook caller, provided as a string without any parsing or modifications
Return Error to Webhook Caller	`customResponse`	`boolean`	If `True`, returns a `401: Invalid credentials` error in the case of invalid authorization. Make sure to configure the HTTP trigger to "Return a custom response from your workflow". If `False`, does not return a custom response in the case of invalid auth.

Authentication#

The HTTP / Webhook API does not require authentication.

About HTTP / Webhook#

Get a unique URL where you can send HTTP or webhook requests

More Ways to Use HTTP / Webhook#

Triggers#

New Requests from the HTTP / Webhook API

Get a URL and emit the full HTTP event on every request (including headers and query parameters). You can also configure the HTTP response code, body, and more.

Try it

New Requests (Payload Only) from the HTTP / Webhook API

Get a URL and emit the HTTP body as an event on every request

Try it

New event when the content of the URL changes. from the HTTP / Webhook API

Emit new event when the content of the URL changes.

Try it