---
title: "Verifying a Webhook"
slug: "verifying-a-webhook"
description: "How to verify a webhook is from infoodle: compute an HMAC-SHA256 of the raw request body using the webhook Secret and match the X-Infoodle-Signature header."
updated: 2026-10-17T04:36:00Z
published: 2026-10-17T04:36:00Z
canonical: "help.infoodle.com/verifying-a-webhook"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.infoodle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verifying a Webhook

When you receive a webhook it's best practice to ensure the webhook has been received from infoodle. To do this, your process needs to calculate your own sha256 code and compare with the header sent.

Each delivery contains a Signature and the name of the Event that triggered it.

              Event Headers

              

Each webhook infoodle sends out contains the following 2 headers

X-Infoodle-Signature: sha256=... X-Infoodle-Event: person.created

When you create a new webhook, infoodle will create a new Secret. This key is needed to perform the verification.

              Verification

              

To Verify the received webhook:

- take the url you sent
- and the Secret
- and calculate the sha256
- The value should match the signature sent in the header

expected = "sha256=" + hmac_sha256( raw_request_body, secret_key ) assert(expected == header["X-Infoodle-Signature"])