Every webhook request from ekko includes a signature header that you can use to verify the request is authentic and hasn’t been tampered with.

🔄

This page reflects the current API behaviour. Some details may change as v3 is finalised.

Signature details

Request contents

Each webhook request includes the following:

Body:

• timestamp: ISO 8601 time when the webhook was prepared
• Event-specific fields for the configured event type (see Webhooks for the full payload reference)

Headers:

• Content-Type: application/json
• signature: the HMAC digest as a lowercase hex string

How to verify

1. Read the signature header from the incoming request
2. Compute an HMAC-SHA256 digest using your organisationId as the key and the exact request body as the message
3. Encode the digest as a lowercase hex string
4. Compare it to the signature header value

If the values match, the request is authentic. If they don’t, reject it.