> ## Documentation Index
> Fetch the complete documentation index at: https://redbark.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify webhook signatures

> Validate Redbark webhook requests with the destination secret, timestamp, and unmodified request body.

Redbark signs every webhook request with HMAC-SHA256. Use the signing secret generated for that destination.

## Required headers

* `X-Redbark-Signature`: `sha256=<hex digest>`
* `X-Redbark-Timestamp`: Unix timestamp in seconds
* `X-Redbark-Delivery-Id`: stable idempotency key for retries of the same delivery

## Verification

1. Read the raw request body before parsing JSON.
2. Read the timestamp header.
3. Build `<timestamp>.<raw_body>`.
4. Compute its HMAC-SHA256 digest with the destination signing secret.
5. Compare the result with the signature header using a timing-safe comparison.
6. Reject timestamps older than five minutes.

<Warning>
  Do not parse and re-serialise the JSON before verification. Even harmless whitespace or key-order changes produce a different signature.
</Warning>

If you rotate the secret or edit the webhook URL, Redbark generates a new secret. Update your receiver before the next sync or it will reject deliveries.

See the [webhook payload reference](/docs/api-reference/webhooks#request-headers) for implementation examples and the full contract.