Verifying CPaaS webhook signatures

See also

Sources

1. 1
   With Bandwidth webhook basic authentication enabled, Bandwidth first sends the callback without credentials, expects a 401 with a WWW-Authenticate challenge, then resends it with a Basic Authorization header.

   Numbers Webhooks · Numbers Webhooks > Authentication · Checked 2026-10-14
2. 2
   If the receiver's 401 response lacks a WWW-Authenticate header, Bandwidth does not retry with credentials and the callback is not delivered.

   Numbers Webhooks · Numbers Webhooks > Authentication · Checked 2026-10-14
3. 3
   The Bandwidth webhook pages reviewed describe HTTP Basic authentication but no payload signature, so a Bandwidth receiver authenticates the sender by credentials rather than verifying a body HMAC or public-key signature.inferred

   Messaging Webhooks · Messaging Webhooks > Overview (no authentication or signature section) · Checked 2026-10-14
4. 4
   Plivo V3 signatures are HMAC-SHA256 keyed with the Plivo auth token and Base64-encoded.

   Signature validation-V3 · Signature validation-V3 > Signature generation logic > Signing with Auth Token · Checked 2026-10-14
5. 5
   When a Plivo account has more than one active auth token, the signature header contains a comma-separated list of signatures, one per token.

   Signature validation-V3 · Signature validation-V3 > Signature generation logic > Signing with Auth Token · Checked 2026-10-14
6. 6
   The Plivo V3 signed string is the full final request URL including scheme, port and query string, followed for POST requests by the parameters sorted case-sensitively by name, followed by the nonce.

   Signature validation-V3 · Signature validation-V3 > Signature generation logic > Concatenating with nonce value · Checked 2026-10-14
7. 7
   Plivo has deprecated X-Plivo-Signature-V2 and recommends V3 because V3 better protects POST payloads from tampering.

   Signature validation-V3 · Signature validation-V3 > Deprecation notice: X-Plivo-Signature-v2 · Checked 2026-10-14
8. 8
   Plivo V3 callbacks carry X-Plivo-Signature-V3 (signed with the auth token of the owning account or subaccount), X-Plivo-Signature-Ma-V3 (signed with the main account auth token) and X-Plivo-Signature-V3-Nonce.

   Signature validation-V3 · Signature validation-V3 > header descriptions · Checked 2026-10-14
9. 9
   RFC 2104 defines HMAC as H(K XOR opad, H(K XOR ipad, text)) over any iterated hash function H with secret key K.

   RFC 2104: HMAC: Keyed-Hashing for Message Authentication · RFC 2104 Section 2 (Definition of HMAC) · Checked 2026-10-14
10. 10
    RFC 2104 strongly discourages HMAC keys shorter than the hash output length L and recommends random keys that are refreshed periodically.

    RFC 2104: HMAC: Keyed-Hashing for Message Authentication · RFC 2104 Section 3 (Keys) · Checked 2026-10-14
11. 11
    Sinch requires Conversation API signature validation to run on the raw body before any JSON parsing, because the HMAC is sensitive to whitespace.

    Conversation API callbacks · Authenticating Callbacks > HMAC (validation warning) · Checked 2026-10-14
12. 12
    Sinch Conversation API callbacks include x-sinch-webhook-signature, x-sinch-webhook-signature-timestamp, x-sinch-webhook-signature-nonce and x-sinch-webhook-signature-algorithm headers only when a secret is set on the webhook.

    Conversation API callbacks · Authenticating Callbacks > HMAC · Checked 2026-10-14
13. 13
    The Sinch Conversation API signature is a Base64-encoded HMAC-SHA256, keyed with the webhook secret, over rawBody + '.' + nonce + '.' + timestamp.

    Conversation API callbacks · Authenticating Callbacks > HMAC (signed data and example code) · Checked 2026-10-14
14. 14
    Sinch SMS callbacks can be authenticated with Basic auth, OAuth 2.0, HMAC or AWS SNS; HMAC is enabled through the Sinch account manager, can be combined with Basic or OAuth, and can apply to one URL or a whole Service Plan.

    SMS API reference: Webhooks · SMS API reference > Webhooks / Callbacks (callback authentication) · Checked 2026-10-14
15. 15
    Sinch Voice callbacks are signed in an Authorization header of the form 'service <serviceKey>:<Signature>', where the signature is Base64(HMAC-SHA256) keyed with the Base64-decoded service secret.

    Webhook Request Signing (Voice) · Webhook Request Signing (header format and signature formula) · Checked 2026-10-14
16. 16
    The Sinch Voice StringToSign is the HTTP method, the Content-MD5 (Base64 MD5 of the body), the content-type, the canonicalised x-timestamp header and the request path, in that order.

    Webhook Request Signing (Voice) · Webhook Request Signing > StringToSign · Checked 2026-10-14
17. 17
    Sinch Voice callbacks carry an x-timestamp header in ISO 8601 UTC that is covered by the signature and used to reject requests that are too old.

    Webhook Request Signing (Voice) · Webhook Request Signing > Timestamp · Checked 2026-10-14
18. 18
    Standard Webhooks defines v1 (HMAC-SHA256 with a shared secret) and v1a (Ed25519) signatures, serialised as <version>,<base64 signature>.

    Standard Webhooks specification · standard-webhooks.md > Signature scheme (symmetric and asymmetric) · Checked 2026-10-14
19. 19
    Standard Webhooks requires symmetric signature verification to use a constant-time comparison to avoid timing attacks.

    Standard Webhooks specification · standard-webhooks.md > Verifying webhook authenticity · Checked 2026-10-14
20. 20
    Standard Webhooks 1.0.0 defines webhook-id (constant across retries), webhook-timestamp (Unix seconds) and webhook-signature headers.

    Standard Webhooks specification · standard-webhooks.md > Webhook headers · Checked 2026-10-14
21. 21
    Standard Webhooks tells consumers to reject timestamps outside an allowable tolerance to prevent replay, but does not set a specific tolerance value.

    Standard Webhooks specification · standard-webhooks.md > Verifying webhook authenticity (timestamp) · Checked 2026-10-14
22. 22
    Standard Webhooks warns that parsing and re-serialising the JSON body can change whitespace or key order and break verification, so consumers should verify against the raw body.

    Standard Webhooks specification · standard-webhooks.md > Signature scheme (payload bytes) · Checked 2026-10-14
23. 23
    The Standard Webhooks webhook-signature header may hold several space-delimited signatures so a sender can sign with old and new keys during rotation; receivers accept the message if any one matches.

    Standard Webhooks specification · standard-webhooks.md > Signature scheme (multiple signatures) · Checked 2026-10-14
24. 24
    Standard Webhooks symmetric secrets are random, 24 to 64 bytes, base64-encoded and prefixed whsec_; asymmetric keys use whsk_ and whpk_ prefixes.

    Standard Webhooks specification · standard-webhooks.md > Signing secrets · Checked 2026-10-14
25. 25
    Under Standard Webhooks the signed content is msg_id.timestamp.payload, joined with full stops, using the exact bytes sent.

    Standard Webhooks specification · standard-webhooks.md > Signature scheme (signed content) · Checked 2026-10-14
26. 26
    Telnyx advises rejecting webhooks whose telnyx-timestamp is more than 5 minutes old to prevent replay attacks.

    Receiving Webhooks (Messaging) · Receiving Webhooks > Webhook signature verification (timestamp check) · Checked 2026-10-14
27. 27
    Telnyx states that it signs every webhook delivery with an Ed25519 signature.

    Node.js SDK webhooks · Node.js SDK webhooks > introduction · Checked 2026-10-14
28. 28
    Telnyx webhooks carry a Base64-encoded Ed25519 signature in the telnyx-signature-ed25519 header and the Unix signing time in the telnyx-timestamp header.

    Receiving Webhooks (Messaging) · Receiving Webhooks > Webhook signature verification · Checked 2026-10-14
29. 29
    In the Telnyx Node.js SDK, client.webhooks.unwrap() verifies the signature over the raw body and headers and throws on mismatch, while client.webhooks.unsafeUnwrap() skips verification and is meant only for pre-verified payloads or tests.

    Node.js SDK webhooks · Node.js SDK webhooks > Verify and parse an event; Skipping verification · Checked 2026-10-14
30. 30
    The Telnyx public key used to verify webhook signatures is obtained from the Mission Control Portal under Keys & Credentials > Public Key.

    Receiving Webhooks (Messaging) · Receiving Webhooks > Webhook signature verification (public key) · Checked 2026-10-14
31. 31
    Telnyx signature verification must run on the exact raw request bytes, not on a re-serialised JSON object.

    Receiving Webhooks (Messaging) · Receiving Webhooks > Troubleshooting (signature verification) · Checked 2026-10-14
32. 32
    The Telnyx Ed25519 signature is computed over the timestamp, a pipe character and the JSON payload, in the form {timestamp}|{json_payload}.

    Receiving Webhooks (Messaging) · Receiving Webhooks > Webhook signature verification (signed payload) · Checked 2026-10-14
33. 33
    Twilio also supports HTTP Basic and Digest authentication for webhook URLs, with the credentials embedded in the URL, as a complement to signature validation.

    Secure webhooks · Webhooks security > HTTP authentication · Checked 2026-10-14
34. 34
    Twilio signature validation must be given the exact webhook URL Twilio requested, including its query string and original URL encoding; decoding or re-encoding the URL causes validation to fail.

    Secure webhooks · Webhooks security > query parameters guidance · Checked 2026-10-14
35. 35
    For form-encoded Twilio webhooks, the POST parameters are sorted alphabetically by name and each name and value is appended to the full webhook URL before the HMAC is computed.

    Secure webhooks · Webhooks security > Validating signatures from Twilio (form parameters) · Checked 2026-10-14
36. 36
    Twilio signs the HTTP requests it sends to an application's webhook URLs with an X-Twilio-Signature HTTP header.

    Secure webhooks · Webhooks security > Validating signatures from Twilio (opening paragraph) · Checked 2026-10-14
37. 37
    The X-Twilio-Signature value is an HMAC-SHA1 computed with the account's auth token as the key.

    Secure webhooks · Webhooks security > Validating signatures from Twilio (how the signature is computed) · Checked 2026-10-14
38. 38
    For application/json Twilio webhooks, Twilio adds a bodySHA256 query parameter carrying the SHA-256 hash of the raw body, and validation must use the raw body string rather than parsed JSON properties.

    Secure webhooks · Webhooks security > Validating requests with a JSON body · Checked 2026-10-14
39. 39
    Because Twilio's documented signature input (auth token, URL, sorted parameters or body hash) contains no timestamp or nonce, a valid X-Twilio-Signature by itself does not bound how long a captured request can be replayed; replay defence relies on TLS and application-level idempotency.inferred

    Secure webhooks · Webhooks security > list of inputs combined into the signature · Checked 2026-10-14
40. 40
    Twilio recommends validating X-Twilio-Signature with the validation utility in a Twilio SDK and advises against writing a custom validator.

    Secure webhooks · Webhooks security > Validating signatures from Twilio (SDK recommendation) · Checked 2026-10-14
41. 41
    twilio-node 5.4.3, dated 2025-01-28, made signature validation succeed whether query-string values in the webhook URL are escaped or unescaped.

    twilio-node CHANGES.md · CHANGES.md > 5.4.3 (2025-01-28), PR #1061 fixes #1059 · Checked 2026-10-14
42. 42
    twilio-node 6.2.0, dated 2026-10-12, replaced the deprecated scmp library with crypto.timingSafeEqual for signature comparison.

    twilio-node CHANGES.md · CHANGES.md > 6.2.0 (2026-10-12), PR #1218 · Checked 2026-10-14
43. 43
    The twilio-node validateRequest function tests the signature against the URL both with the default port added (:443 for https, :80 otherwise) and with any port removed, then retries with a normalised URL and a legacy query-string encoding.

    twilio-node src/webhooks/webhooks.ts (main branch) · src/webhooks/webhooks.ts > validateRequest, addPort, removePort, withLegacyQuerystring · Checked 2026-10-14
44. 44
    The twilio-node SDK compares the computed and received signatures with crypto.timingSafeEqual after an explicit length check.

    twilio-node src/webhooks/webhooks.ts (main branch) · src/webhooks/webhooks.ts > safeCompare, validateSignatureWithUrl · Checked 2026-10-14
45. 45
    Signature schemes that include the full request URL (Twilio, Plivo V3) fail when a reverse proxy or TLS terminator changes the scheme, host, port or query encoding the application sees, so the validator must be fed the public URL the CPaaS requested.inferred

    Signature validation-V3 · Signature validation-V3 > Signature generation logic (full final URL incl. scheme, port, query) · Checked 2026-10-14
46. 46
    Vonage signs webhooks by default for the Messages, Dispatch, Verify and Voice APIs.

    Webhooks · Webhooks > Signed webhooks · Checked 2026-10-14
47. 47
    Vonage signed webhooks carry a JWT in the Authorization header (Bearer scheme), signed with the account signature secret; the documented sample token uses HS256.

    Webhooks · Webhooks > Signed webhooks > Verifying the request · Checked 2026-10-14
48. 48
    Vonage Voice applications created before signed webhooks existed have signing off by default, and it can be turned on under Show advanced features in the Voice capability settings.

    Webhooks · Webhooks > Signed webhooks (Voice applications note) · Checked 2026-10-14
49. 49
    Messages API webhooks from Vonage are always signed with SHA-256 regardless of the signature method chosen in the dashboard dropdown.

    Webhooks · Webhooks > Signed webhooks (Messages API note) · Checked 2026-10-14
50. 50
    The Vonage webhook JWT includes a payload_hash claim holding the SHA-256 of the request body; Vonage describes comparing it as optional and needed mainly when webhooks travel over plain HTTP.

    Webhooks · Webhooks > Signed webhooks > JWT claims table; Verifying the payload · Checked 2026-10-14
51. 51
    Vonage SMS signing offers MD5 hash (the default), MD5 HMAC, SHA1 HMAC, SHA-256 HMAC and SHA-512 HMAC, selected in the dashboard alongside the signature secret.

    Signing Messages · Signing Messages > Use signatures when sending messages (algorithm list) · Checked 2026-10-14
52. 52
    Signing of incoming Vonage SMS and delivery-receipt webhooks is off by default and is enabled by contacting Vonage support.

    Signing Messages · Signing Messages > Validate the signature on incoming messages · Checked 2026-10-14
53. 53
    A Vonage SMS sig is built by sorting the parameters (excluding sig) by key, replacing & and = in values with _, concatenating them as &key=value, then hashing with the secret appended (MD5) or as the HMAC key, and hex-encoding the result.

    Signing Messages · Signing Messages > Manually generate a signature (steps 1-5) · Checked 2026-10-14
54. 54
    Vonage's sig-parameter signing mechanism applies only to the SMS API.

    Signing Messages · Signing Messages > introduction · Checked 2026-10-14
55. 55
    If Vonage sends an unsigned callback because of an internal error, the receiver can return a 5xx response to trigger a retry that may arrive signed.

    Webhooks · Webhooks > Signed webhooks (unsigned callbacks); Retries · Checked 2026-10-14
56. 56
    The Webex Connect page's description of the x-hub-signature as a '40-byte' hex value matches SHA-1 output length, not the SHA256 (64 hex) or SHA512 (128 hex) algorithms it now offers, so receivers should not length-check against 40.inferred

    Outbound Webhooks · Outbound Webhooks > Hub Signature description '(40-byte)' · Checked 2026-10-14
57. 57
    The Webex Connect FAQ Python sample computes an HMAC over the raw payload and compares it to x-hub-signature with ==, not a constant-time comparison.

    Outbound Webhooks · Outbound Webhooks > FAQ (Python verification sample) · Checked 2026-10-14
58. 58
    Webex Connect outbound webhook signing (hub signature) is optional but recommended; when enabled, each notification carries an x-hub-signature header holding a hex HMAC of the notification data keyed with the hub secret.

    Outbound Webhooks · Outbound Webhooks > Configuring Outbound Webhooks at a Service Level (Hub Signature) · Checked 2026-10-14
59. 59
    Webex Connect no longer allows SHA1 for new outbound webhook configurations and offers HMAC with SHA256 or SHA512; webhooks configured before the 'April 22 release' are not affected.

    Outbound Webhooks · Outbound Webhooks > Configuring Outbound Webhooks at a Service Level (algorithm note) · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Verifying CPaaS webhook signatures. WarmTransfer. https://warmtransfer.net/knowledge/cpaas-webhook-signature-verification

@misc{warmtransfer-cpaas-webhook-signature-verification,
  title  = {Verifying CPaaS webhook signatures},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cpaas-webhook-signature-verification},
  note   = {Verified 2026-10-14}
}