> ## Documentation Index
> Fetch the complete documentation index at: https://sigma-docs.pastelhq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Signature

> Webhook signatures are used to ensure the integrity and authenticity of the data received through webhooks.

### Overview

Every webhook Sigma sends includes a signature in the request headers. You should verify this signature before processing any webhook payload to ensure the request genuinely came from Sigma and was not tampered with.

```javascript theme={null}
x-signature: {your-received-signature}
```

Always verify the signature before acting on the webhook payload.

### How the Signature is Generated

Sigma generates the signature by:

1. Concatenating your `apiKey` and `apiSecret` (with no separator): `{apiKey}{apiSecret}`
2. Hashing the concatenated string using the HMAC-SHA256 algorithm, with your `businessId` as the payload

The result is the signature sent in the `x-signature` header.

### How to Verify the Signature

To verify an incoming webhook:

1. Retrieve the `x-signature` value from the request headers
2. Concatenate your `apiKey` and `apiSecret` to form your hash secret
3. Generate an HMAC-SHA256 hash of your `businessId` using the hash secret
4. Compare your generated hash against the received signature — if they match, the webhook is valid

Your `businessId` is available on the Webhooks page in the Sigma dashboard.

<CodeGroup>
  ```javascript javascript theme={null}
  const crypto = require("crypto");

  // Your secret key for generating and verifying signatures
  const hashSecret = "{your-api-key}{your-secret-key}";
  // Example: 80a2dc85-1o0s-4405-8cc4-08c1f457011b5b5e4b16-4f22-45d2-9poc-5e4e60915719

  // Received webhook payload and signature from the request headers
  const businessId =
    "{your-business-id}"; /* Extract business ID from webhook page on Sigma dashboard */
  const receivedSignature =
    "{your-received-signature}"; /* Extract signature from request headers */

  // Function to generate a signature for a given payload
  function generateSignature(payload: string) {
    const hmac = crypto.createHmac("sha256", hashSecret);
    hmac.update(payload);
    return hmac.digest("hex");
  }

  // Validate the received signature
  const generatedSignature = generateSignature(businessId);

  if (generatedSignature === receivedSignature) {
    console.log(
      "Webhook signature is valid. Proceed with processing the payload."
    );
  } else {
    console.log("Webhook signature is invalid. Do not process the payload.");
  }
  ```

  ```php PHP theme={null}
  $hashSecret = '{your-api-key}{your-secret-key}';
  $businessId = '{your-business-id}';
  $receivedSignature = '{your-received-signature}';

  $generatedSignature = generateSignature($hashSecret, $businessId);

  if ($generatedSignature === $receivedSignature) {
      echo "Webhook signature is valid. Proceed with processing the payload.\n";
  } else {
      echo "Webhook signature is invalid. Do not process the payload.\n";
  }

  function generateSignature($secret, $payload)
  {
      return hash_hmac('sha256', $payload, $secret);
  }
  ```

  ```python Python theme={null}
  import hashlib
  import hmac

  # Your secret key for generating and verifying signatures
  hash_secret = "{your-api-key}{your-secret-key}"
  # Example: 80a2dc85-1o0s-4405-8cc4-08c1f457011b5b5e4b16-4f22-45d2-9poc-5e4e60915719

  # Received webhook payload and signature from the request headers
  business_id = "{your-business-id}"  # Extract business ID from webhook page on Sigma dashboard
  received_signature = "{your-received-signature}"  # Extract signature from request headers

  # Function to generate a signature for a given payload
  def generate_signature(payload):
      return hmac.new(
          hash_secret.encode('utf-8'),
          payload.encode('utf-8'),
          hashlib.sha256
      ).hexdigest()

  # Validate the received signature
  generated_signature = generate_signature(business_id)

  if generated_signature == received_signature:
      print("Webhook signature is valid. Proceed with processing the payload.")
  else:
      print("Webhook signature is invalid. Do not process the payload.")
  ```

  ```java Java theme={null}
  import javax.crypto.Mac;
  import javax.crypto.spec.SecretKeySpec;
  import java.nio.charset.StandardCharsets;
  import java.security.InvalidKeyException;
  import java.security.NoSuchAlgorithmException;

  public class WebhookValidator {

      private static final String hashSecret = "{your-api-key}{your-secret-key}";
      private static final String businessId = "{your-business-id}";
      private static final String receivedSignature = "{your-received-signature}";

      public static void main(String[] args) {
          String generatedSignature = generateSignature(businessId);
          if (generatedSignature.equals(receivedSignature)) {
              System.out.println("Webhook signature is valid. Proceed with processing the payload.");
          } else {
              System.out.println("Webhook signature is invalid. Do not process the payload.");
          }
      }

      private static String generateSignature(String payload) {
          try {
              Mac sha256Hmac = Mac.getInstance("HmacSHA256");
              SecretKeySpec secretKey = new SecretKeySpec(hashSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
              sha256Hmac.init(secretKey);
              byte[] hmacBytes = sha256Hmac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
              return bytesToHex(hmacBytes);
          } catch (NoSuchAlgorithmException | InvalidKeyException e) {
              e.printStackTrace();
              return null;
          }
      }

      private static String bytesToHex(byte[] bytes) {
          StringBuilder hexStringBuilder = new StringBuilder();
          for (byte aByte : bytes) {
              hexStringBuilder.append(String.format("%02x", aByte));
          }
          return hexStringBuilder.toString();
      }
  }
  ```

  ```go Go theme={null}
  package main

  import (
  	"crypto/hmac"
  	"crypto/sha256"
  	"encoding/hex"
  	"fmt"
  )

  // Your secret key for generating and verifying signatures
  var hashSecret = "{your-api-key}{your-secret-key}"
  // Example: 80a2dc85-1o0s-4405-8cc4-08c1f457011b5b5e4b16-4f22-45d2-9poc-5e4e60915719

  // Received webhook payload and signature from the request headers
  var businessID = "{your-business-id}" // Extract business ID from webhook page on Sigma dashboard
  var receivedSignature = "{your-received-signature}" // Extract signature from request headers

  // Function to generate a signature for a given payload
  func generateSignature(payload string) string {
  	h := hmac.New(sha256.New, []byte(hashSecret))
  	h.Write([]byte(payload))
  	return hex.EncodeToString(h.Sum(nil))
  }

  func main() {
  	generatedSignature := generateSignature(businessID)

  	if generatedSignature == receivedSignature {
  		fmt.Println("Webhook signature is valid. Proceed with processing the payload.")
  	} else {
  		fmt.Println("Webhook signature is invalid. Do not process the payload.")
  	}
  }
  ```
</CodeGroup>