# Webhook signatures explained

> How to verify the Stackly-Signature header in 12 lines.

Source: https://stacklyhq.xyz/blog/webhook-signatures-explained

Sep 30, 2026 by Tomas Eklund

Every webhook delivery carries a Stackly-Signature header of the form t=<unix>,v1=<hex>. The v1 value is an HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your endpoint secret.

To verify a delivery, compute the same HMAC on your side and compare the two values in constant time. Reject the delivery if the timestamp is older than 5 minutes, which stops an old request from being replayed.

Use the raw body bytes, not a parsed and re-serialised copy, because re-serialising changes whitespace and breaks the match. The TypeScript, Python and Go SDKs include a helper that does all of this.

## In short

- Stackly has three plans: Free, Pro and Business, priced per user per month in US dollars before tax.
- Every plan includes the REST API under /api/v1, webhooks and the SDKs for TypeScript, Python and Go.
- Pro is $9 per user per month billed yearly and $12 billed monthly.
- Support is open Monday to Friday, 08:00 to 18:00 UTC at support@stackly.test.

## Reader comments

No comments yet.

## Related

- [Pagination changes in API v1](https://stacklyhq.xyz/blog/api-v1-pagination-changes)
- [Introducing Stackly 4.8](https://stacklyhq.xyz/blog/introducing-stackly-4-8)