Skip to main content
Redbark signs every webhook request with HMAC-SHA256. Use the signing secret generated for that destination.

​
Required headers

  • X-Redbark-Signature: sha256=<hex digest>
  • X-Redbark-Timestamp: Unix timestamp in seconds
  • X-Redbark-Delivery-Id: stable idempotency key for retries of the same delivery

​
Verification

  1. Read the raw request body before parsing JSON.
  2. Read the timestamp header.
  3. Build <timestamp>.<raw_body>.
  4. Compute its HMAC-SHA256 digest with the destination signing secret.
  5. Compare the result with the signature header using a timing-safe comparison.
  6. Reject timestamps older than five minutes.
Do not parse and re-serialise the JSON before verification. Even harmless whitespace or key-order changes produce a different signature.
If you rotate the secret or edit the webhook URL, Redbark generates a new secret. Update your receiver before the next sync or it will reject deliveries. See the webhook payload reference for implementation examples and the full contract.