Payments glossary
What is a webhook signature?
A webhook signature is a cryptographic hash, usually HMAC-SHA256, that a sender attaches to each webhook so the receiver can prove it is genuine and unmodified.
The receiver recomputes the HMAC of the raw request body with a shared secret and compares it in constant time. A timestamp in the signature prevents replay of old events.
How it works in Allidian
Allidian signs every webhook with an x-platform-signature header (t=timestamp,v1=HMAC). The automated connection test checks that your endpoint accepts valid signatures and rejects invalid ones.