---
title: How do I verify that a webhook came from AwareGO?
description: Use the signature secret and the request signature header to confirm a webhook genuinely came from AwareGO.
---

[Skip to content](https://help.awarego.com/webhooks-verification#main-content)

English

Show submenu for translations

![Logo-1.png\]](https://help.awarego.com/hs-fs/hubfs/Logo-1.png?width=113&height=22&name=Logo-1.png)

- [Videos](https://awarego.com/security-awareness-videos/)
- [Pricing](https://awarego.com/pricing/)
- [Security awareness](https://awarego.com/security-awareness-training/)
- [Blog](https://blog.awarego.com/)
- [About](https://awarego.com/about/)

Open main navigation

Close main navigation

- [Videos](https://awarego.com/security-awareness-videos/)
- [Pricing](https://awarego.com/pricing/)
- [Security awareness](https://awarego.com/security-awareness-training/)
- [Blog](https://blog.awarego.com/)
- [About](https://awarego.com/about/)
- English
  
  Show submenu for translations
- Contact us

 Contact us

 Hi. How can we help?

- There are no suggestions because the search field is empty.

1. [Help Center](https://help.awarego.com/?hsLang=en)
2. [Webhooks](https://help.awarego.com/webhooks?hsLang=en)

# How do I verify that a webhook came from AwareGO?

## Confirm each request is genuine using your signature secret.

If you set a **signature secret** on the webhook, every request carries a signature header `x-signature` containing an HMAC-SHA256 of the **raw request body**, keyed with your secret.

To verify, recompute the HMAC over the exact bytes you received and compare it to the header. This is an example in TypeScript:

`import { createHmac, timingSafeEqual } from 'crypto';`  
`// Example only`  
`// `rawBody` must be the exact bytes received, before any JSON parsing/re-serialization.`  
`function isFromAwareGo(`  
`  rawBody: string,`  
`  signatureHeader: string,`  
`  secret: string`  
`): boolean {`  
`  const expected = createHmac('sha256', secret)`  
`    .update(rawBody, 'utf8')`  
`    .digest('hex');`

`  const a = Buffer.from(expected);`  
`  const b = Buffer.from(signatureHeader);`  
`  return a.length === b.length && timingSafeEqual(a, b);`  
`}`

 **Important:** hash the **raw** body, not a re-serialized version — re-encoding can change the bytes and break the comparison. Reject any request whose signature doesn't match.

- [Getting Started](https://help.awarego.com/getting-started?hsLang=en)
- [Training Programs](https://help.awarego.com/training-programs?hsLang=en)
- [Employees](https://help.awarego.com/employees?hsLang=en)
- [Reporting](https://help.awarego.com/reporting?hsLang=en)
- [Integrations](https://help.awarego.com/integrations?hsLang=en#main-content)
  
  
  
  
  
    - [Slack](https://help.awarego.com/integrations?hsLang=en#slack)
    - [Active Directory](https://help.awarego.com/integrations?hsLang=en#active-directory)
    - [Google Suites](https://help.awarego.com/integrations?hsLang=en#google-suites)
    - [SSO](https://help.awarego.com/integrations?hsLang=en#sso)
- [Account Management](https://help.awarego.com/account-management?hsLang=en)
- [Embedded Player](https://help.awarego.com/embedded-player?hsLang=en)
- [Copyright and Legal](https://help.awarego.com/copyright-and-legal?hsLang=en)
- [Partners](https://help.awarego.com/partners?hsLang=en)
- [Security](https://help.awarego.com/security?hsLang=en)
- [Content](https://help.awarego.com/content?hsLang=en)
- [Webhooks](https://help.awarego.com/webhooks?hsLang=en)
- [Other](https://help.awarego.com/other?hsLang=en)
- [Human Risk Assessment](https://help.awarego.com/human-risk-assessment?hsLang=en)

[![Chill listening crop-3](https://help.awarego.com/hs-fs/hubfs/Logo.png?width=113&height=22&name=Logo.png "Chill listening crop-3")](https://www.awarego.com/)

support@awarego.com

<https://www.linkedin.com/company/awarego.com/>

Copyright © 2026, AwareGO

![](https://www.facebook.com/tr?id=742074739469756&ev=PageView&noscript=1)