Webhook Security

Why verify webhooks?

Anyone can send a POST request to your webhook URL. Verifying the signature ensures the request actually came from Brykto and was not tampered with.

How it works

Every webhook request from Brykto includes an X-Brykto-Signature header. This is an HMAC-SHA256 signature of the raw request body, using your webhook secret as the key.

Verifying in code

import hmac
import hashlib

def verify_signature(body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Getting your webhook secret

Go to Developers in your dashboard. Your webhook secret is shown there. Rotate it the same way as an API key if you believe it has been compromised.

Replay protection

Each order.paid event includes a unique transaction hash (tx_hash). Store confirmed tx_hash values and reject any duplicate events.