Source note · What a Webex webhook guarantees

Cisco instructs a webhook receiver to compute the HMAC over the unmodified raw request bytes before parsing or re-serialising the JSON, to compare the expected and received signatures in constant time before processing the payload, and to look the header up case-insensitively because Webex may deliver it in lowercase over HTTP/2.

Checked 2026-09-16

Compute the HMAC over the raw request bytes before parsing or re-serializing JSON, and compare signatures in constant time before processing the payload.

Vendor: Cisco
Product: Webex Calling
Subsystem: Webhooks
Deployment: not restricted
Region: not restricted
Release range: not restricted
Checked: 2026-09-16

Sources

Webex for Developers — Webhooks — Cisco Systems, Inc. (developer.webex.com) · tier 2 current vendor documentation · Webhooks guide, Authenticating Requests section

Cite this note

APA

WarmTransfer. (2026, September 16). What a Webex webhook guarantees: source note wxwh-verify-over-raw-bytes-in-constant-time. WarmTransfer. https://warmtransfer.net/knowledge/claims/wxwh-verify-over-raw-bytes-in-constant-time

BibTeX

@misc{warmtransfer-claim-wxwh-verify-over-raw-bytes-in-constant-time,
  title  = {What a Webex webhook guarantees: source note wxwh-verify-over-raw-bytes-in-constant-time},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/claims/wxwh-verify-over-raw-bytes-in-constant-time},
  note   = {Source note wxwh-verify-over-raw-bytes-in-constant-time, checked 2026-09-16}
}

Read in context