How do I verify that a webhook came from AwareGO?

If you set a signature secret on the webhook, every request carries a signature header x-signature containing an HMAC-SHA256 of the raw request body, keyed with your secret.

To verify, recompute the HMAC over the exact bytes you received and compare it to the header. This is an example in TypeScript:

^{import { createHmac, timingSafeEqual } from 'crypto';}
^{// Example only}
^{// `rawBody` must be the exact bytes received, before any JSON parsing/re-serialization.}
^{function isFromAwareGo(}
^{rawBody: string,}
^{signatureHeader: string,}
^{secret: string}
^{): boolean {}
^{const expected = createHmac('sha256', secret)}
^{.update(rawBody, 'utf8')}
^{.digest('hex');}

^{const a = Buffer.from(expected);}
^{const b = Buffer.from(signatureHeader);}
^{return a.length === b.length && timingSafeEqual(a, b);}
^}

^{Important: hash the raw body, not a re-serialized version — re-encoding can change the bytes and break the comparison. Reject any request whose signature doesn't match.}

How do I verify that a webhook came from AwareGO?

Confirm each request is genuine using your signature secret.