Webhook signatures explained
by Tomas Eklund
Every webhook delivery carries a Stackly-Signature header of the form t=<unix>,v1=<hex>. The v1 value is an HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your endpoint secret.
To verify a delivery, compute the same HMAC on your side and compare the two values in constant time. Reject the delivery if the timestamp is older than 5 minutes, which stops an old request from being replayed.
Use the raw body bytes, not a parsed and re-serialised copy, because re-serialising changes whitespace and breaks the match. The TypeScript, Python and Go SDKs include a helper that does all of this.
In short
- Stackly has three plans: Free, Pro and Business, priced per user per month in US dollars before tax.
- Every plan includes the REST API under /api/v1, webhooks and the SDKs for TypeScript, Python and Go.
- Pro is $9 per user per month billed yearly and $12 billed monthly.
- Support is open Monday to Friday, 08:00 to 18:00 UTC at support@stackly.test.
Reader comments
No comments yet.