Worklayer will sign webhook events it sends to your endpoints by including two signature-related headers in the webhook requests. This allows you to verify that the events were sent by Worklayer and not by a third party.

In order to verify the signature, you'll need the secret provided for your webhook notifications subscription. This should've been shared with you during the webhook setup.

Worklayer will include the following two headers on each webhook notification request:

Signatures are generated using HMAC with SHA-256. You can verify the requests sent from Worklayer by following these steps:

To compute the signature, you'll need the following things:

• The signing secret
• The signature from the x-worklayer-signature header
• The timestamp from the x-worklayer-date header
• The actual JSON payload of the event (the request body)

• The timestamp
• The . character
• The JSON payload

Compute an HMAC with the SHA256 hash function using the secret as the key and the signed_event string as the message.

Compare the signature in the header to the expected signature computed in Step 3. They should match.

This example shows a C# function to compute the signature given the secret, the timestamp from the x-worklayer-date header, and the payload as a string.

Copied
1static string ComputeSignature(string secret, string timestamp, string payload) 
2{
3  var secretBytes = Encoding.UTF8.GetBytes(secret);
4  var payloadBytes = Encoding.UTF8.GetBytes($"{timestamp}.{payload}");
5
6  using (var cryptographer = new HMACSHA256(secretBytes));
7  {
8      var hash = cryptographer.ComputeHash(payloadBytes);
9      return Convert.ToBase64String(hashedBytes);
10  }
11}