How webhook providers sign, time out and retry

Payments

Stripe

Stripe signs every event with an HMAC-SHA256 over the timestamp and the raw body, sent in the Stripe-Signature header, and retries failed deliveries for up to three days.

HMAC-SHA256 Stripe-Signature

Code hosting

GitHub

GitHub signs webhook deliveries with an HMAC-SHA256 of the raw body in X-Hub-Signature-256, expects a 2xx within 10 seconds and does not retry failed deliveries automatically.

HMAC-SHA256 X-Hub-Signature-256

Code hosting

GitLab

GitLab sends a plain-text secret token in X-Gitlab-Token, or, with a signing token, a Standard Webhooks HMAC-SHA256 signature in webhook-signature; failing webhooks are disabled.

Shared token (or HMAC-SHA256 with a signing token) X-Gitlab-Token

Code hosting

Bitbucket Cloud

Bitbucket Cloud signs webhooks that have a secret with an HMAC-SHA256 of the raw body, sent as X-Hub-Signature: sha256=….

HMAC-SHA256 X-Hub-Signature

Commerce

Shopify

Shopify signs webhooks with a base64 HMAC-SHA256 of the raw body, keyed with the app's client secret, and expects a 200 within five seconds.

HMAC-SHA256 X-Shopify-Hmac-Sha256

Messaging

Slack

Slack signs requests with v0= HMAC-SHA256 of "v0:{timestamp}:{body}" using the app's signing secret, and expects an answer within three seconds.

HMAC-SHA256 X-Slack-Signature

Messaging

Twilio

Twilio signs the full webhook URL plus the sorted POST parameters with HMAC-SHA1 and your Auth Token, base64-encoded in X-Twilio-Signature.

HMAC-SHA1 X-Twilio-Signature

Payments

Paddle Billing

Paddle Billing signs notifications with HMAC-SHA256 over "{ts}:{body}" in the Paddle-Signature header, expects a 200 within five seconds and retries for about two days.

HMAC-SHA256 Paddle-Signature

Video

Zoom

Zoom signs webhooks with v0= HMAC-SHA256 of "v0:{timestamp}:{body}" using the app's secret token, validates the URL with a challenge, and retries three times.

HMAC-SHA256 x-zm-signature

Productivity

Linear

Linear signs webhooks with a hex HMAC-SHA256 of the raw body in Linear-Signature and puts the send time in webhookTimestamp for replay checks.

HMAC-SHA256 Linear-Signature

Payments

Square

Square signs the notification URL followed by the raw body with HMAC-SHA256 and the subscription's signature key, base64-encoded, and retries for 24 hours.

HMAC-SHA256 x-square-hmacsha256-signature

Payments

PayPal

PayPal signs webhooks with SHA256withRSA over "transmission id|time|webhook id|CRC32 of the body", with a certificate you fetch from PAYPAL-CERT-URL; it retries up to 25 times over 3 days.

SHA256withRSA (certificate) PAYPAL-TRANSMISSION-SIG

Email

SendGrid

SendGrid's signed Event Webhook uses ECDSA: a base64 signature over the timestamp header plus the raw body, checked with the public verification key from your settings.

ECDSA P-256 with SHA-256 X-Twilio-Email-Event-Webhook-Signature

Email

Mailgun

Mailgun puts a signature object in the JSON body: hex HMAC-SHA256 of timestamp + token with your HTTP webhook signing key; a 406 answer stops retries.

HMAC-SHA256 (signature object in the JSON body)

Messaging

Discord

Discord signs interactions and webhook events with Ed25519 over timestamp + body, verified with the application's public key, and needs an answer within 3 seconds.

Ed25519 X-Signature-Ed25519

Webhook infrastructure

Svix

Svix (used by Clerk, Resend and many others) signs with HMAC-SHA256 over "{svix-id}.{svix-timestamp}.{body}" using the base64 part of a whsec_ secret, and retries over about 27 hours.

HMAC-SHA256 svix-signature

Webhook infrastructure

Standard Webhooks

The Standard Webhooks spec signs "{webhook-id}.{webhook-timestamp}.{body}" with HMAC-SHA256 (v1) or Ed25519 (v1a); the key is the base64 part of a whsec_ secret.

HMAC-SHA256 (v1) or Ed25519 (v1a) webhook-signature

Streaming

Twitch EventSub

Twitch EventSub signs with sha256= HMAC-SHA256 over message id + timestamp + body, needs the challenge echoed as text/plain, and revokes slow endpoints.

HMAC-SHA256 Twitch-Eventsub-Message-Signature

Customer messaging

Intercom

Intercom signs webhook notifications with X-Hub-Signature: sha1= HMAC-SHA1 of the body, keyed with the app's client secret, and resends if it gets no 200 within 5 seconds.

HMAC-SHA1 X-Hub-Signature

CRM

HubSpot

HubSpot's v3 signature is a base64 HMAC-SHA256 over method + URL + body + timestamp, keyed with the app's client secret; requests older than 5 minutes should be rejected.

HMAC-SHA256 X-HubSpot-Signature-v3

Productivity

Jira Cloud

Jira Cloud webhooks registered with a secret carry X-Hub-Signature: sha256= HMAC of the raw body; failures on 408/409/425/429/5xx are retried up to five times.

HMAC-SHA256 X-Hub-Signature

Scheduling

Calendly

Calendly signs webhooks with Calendly-Webhook-Signature: t=…,v1=… (hex HMAC-SHA256 of "{t}.{body}") and retries for 24 hours before disabling the subscription.

HMAC-SHA256 Calendly-Webhook-Signature

Forms

Typeform

Typeform signs webhooks with Typeform-Signature: sha256= followed by a base64 HMAC-SHA256 of the raw body, waits 30 seconds, and disables webhooks on 404 or 410.

HMAC-SHA256 Typeform-Signature