Identify the provider, endpoint secret, expected event types and signature format. Use separate endpoint credentials for test and production.

1. Register the intended HTTPS endpoint with the provider and store its signing secret privately. A webhook signing secret may differ from the account’s ordinary API key.

2. Preserve the request bytes required by the provider’s verification procedure. Use its maintained verification library where available rather than inventing a universal signature format.

3. Validate the signature and any supported timestamp or replay tolerance before processing the event. Keep system time accurate where the protocol depends on it.

4. Check the event type, account or environment and referenced resource before authorising the corresponding application action.

5. Persist an accepted event or enqueue durable work, then return the appropriate acknowledgement. Reject invalid authentication with a controlled response and private diagnostic information.

Add this guard to an existing GitHub webhook handler after enforcing its request-size limit. It checks the provider-specific SHA-256 signature using the untouched body. The private secret belongs in the application’s protected environment, not in the repository or browser.

$secret = getenv('GITHUB_WEBHOOK_SECRET');
if (!is_string($secret) || $secret === '') {
    http_response_code(500);
    exit;
}
$body = file_get_contents('php://input');
$received = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}
// Parse and authorise the verified event before scheduling work.

The signature authenticates these bytes under the shared secret. It does not decide which repository, branch or event may deploy your application. Check those fields after verification and store delivery state so a valid replay cannot repeat an unsafe action.

Expected result: A genuine authorised test event reaches the next stage, while an unsigned or modified request is rejected. No deployment command runs merely because the endpoint returned a response.

Test a genuine provider delivery and a harmless request with an invalid signature. Confirm the invalid request cannot create a customer, mark an order paid or trigger provisioning.

If legitimate verification fails, check the endpoint-specific secret, raw body and exact header format. Disabling verification turns an integration error into an authorization problem.

• Troubleshooting a webhook signature mismatch
• Handling webhook retries without duplicate actions
• Testing an API integration in a separate environment
• Applying HTTP timeouts and limited retries to an API client

• GitHub webhook validation
• Stripe webhook signatures