• INTEGRATIONS AND DEVELOPER API • SETUP GUIDE

How to Verify Webhook Signatures

By Rivio Support Team
2 min read

What you will achieve in this guide

Follow this step-by-step documentation to configure custom B2B registration forms, approval workflows, and customer tagging.

EXPECTED SETUP TIME 5-10 Minutes
COMPATIBILITY All Shopify Themes & Plans
TECHNICAL DIFFICULTY Zero Code Required

Verify optional HMAC-SHA256 signatures on Rivio application webhooks before accepting the payload into your external workflow.

Before you begin

Use the intended service account and select the destination list, channel, spreadsheet tab, or endpoint. Decide whether you are testing a new-submission event or an approval event, and use a clearly identifiable test application.

Verify the unmodified payload

HMAC-SHA256 verification proves that a request body matches the shared secret and supplied signature. Calculate the HMAC over the original request body, not a parsed and re-serialized JSON object, because changing bytes can change the result.

Use the exact signature header and encoding specified in the current technical documentation. Compare signatures in constant time and reject a failed verification before running the business action. Do not hardcode an invented header in your receiver.

Set up this workflow

  1. Set a shared HMAC secret in the app’s outbound webhook settings.

  2. Store the same secret securely on the receiving server.

  3. Use the current technical documentation to identify the signature header and exact payload format.

  4. Calculate the expected HMAC-SHA256 using the unmodified request body.

  5. Compare the supplied and calculated signatures with a constant-time comparison.

  6. Test a valid signed request and a deliberately invalid signature before enabling the workflow.

Example

Use a dummy secret on a controlled test receiver. Verify an authentic payload, then alter its body while keeping the original signature.

Expected result

The original validates and the altered request fails verification; secrets are not included in screenshots.

Limits and important behavior

  • Do not guess the signature header name or encoding; follow the current developer documentation.
  • Parsing and reserializing JSON before hashing can change the bytes and invalidate the comparison.
  • Signature verification confirms the sender/payload integrity, not the business applicant’s eligibility.

Troubleshooting and verification

If verification fails, compare the signing secret, received signature, and exact raw request body with the documented verification method. Re-serializing parsed JSON can change the bytes. Keep secrets out of logs and follow the current in-app header specification.

Screenshots to add

Screenshot placeholder: Capture the relevant app screen for “How to Verify Webhook Signatures” after completing the setup. Show the controls used to set a shared HMAC secret in the app’s outbound webhook settings. Add a second screenshot showing the result of this check: Test a valid signed request and a deliberately invalid signature before enabling the workflow. Use dummy applicant details and mask any secrets.

Related guides