Verifying Signatures
Every delivery is signed with HMAC-SHA256 using the endpoint's signing secret. Always verify this before processing the payload.
Never skip signature verification. Process only requests that pass the check.
How it works
- DKP computes
sha256=+HMAC-SHA256(rawBody, signingSecret) - This value is sent in the
X-DKP-Signatureheader - You compute the same hash and compare using a timing-safe comparison
Code examples
import crypto from 'node:crypto';
function verifySignature(rawBody, signatureHeader, secret) {
const expected = 'sha256=' + crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signatureHeader)
);
}
// Express example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
const sig = req.headers['x-dkp-signature'];
if (!verifySignature(req.body, sig, process.env.DKP_WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature');
}
const event = JSON.parse(req.body);
// process event...
res.sendStatus(200);
});Rotating the secret
You can rotate the signing secret at any time from Settings → Webhooks or via the update endpoint API with rotate_secret: true. The new secret is returned once — store it immediately.