Skip to content
v3Latest
Feedback

Verify webhook signatures

Check the <code>Relay-Signature</code> header with your endpoint secret to make sure the event came from Relay.

On this page

Check the Relay-Signature header with your endpoint secret to make sure the event came from Relay. Here is exactly what to do.

Steps#

  1. Read the header#

    It holds a timestamp and an HMAC-SHA256 signature.

  2. Compute the signature#

    HMAC the timestamp, a dot and the raw body with your endpoint secret.

  3. Compare and check the time#

    Use a constant-time comparison and reject events older than five minutes.

Tip

Always verify against the raw request body, before parsing JSON.

Example#

POST /v3/messages
curl https://api.relay.example/v3/messages \
  -H "Authorization: Bearer $RELAY_KEY" \
  -d channel=sms \
  -d to=+15550100001 \
  -d body="Your code is 482913"

Still stuck?#

Include the request ID from the Relay-Request-Id response header — it lets us find your call in seconds.

Was this article helpful?