To validate a webhook came from mailfloss we suggest verifying the webhook payloads with the x-request-signature header (which we pass with every webhook that has a webhook secret). If you did not add a webhook secret then this header is not included in the payload. You can add or modify the webhook secret at anytime inside of the mailfloss app by editing the corresponding webhook.
The x-request-signature header is a SHA1 HMAC hexdigest computed with the webhook secret and the raw body of the request.
Updated 03 Mar 2023
Did this page help you?