On this page
META AND ACCOUNTS
Webhook signature (HMAC)
A webhook signature is a hash-based message authentication code (HMAC) sent in a header with each webhook request. The sender computes it from the request body and a shared secret; the receiver recomputes it and rejects the request if the two differ, proving the payload is authentic and unmodified.
webhookapp secretverify webhook signaturesapi keys
Why it matters
A webhook URL is effectively public: anyone who guesses it can POST fake events. Without signature verification, a fake "payment received" or "new lead" event would be trusted. Meta signs inbound WhatsApp webhooks with your app secret (header X-Hub-Signature-256); every serious integration signs its outbound events the same way.
In VGraple CRM
Inbound Meta webhooks are verified against your app secret before any processing, and unsigned or mismatched requests are dropped and logged. Outbound webhooks carry an HMAC-SHA256 signature computed with the per-endpoint secret shown once at creation; the verify signatures guide has code samples in Node, Python and PHP.