Webhook Authorization

Once your server is configured to receive webhook payloads, it’ll listen for any payload sent to the URL you configured. For security reasons, you probably want to verify that the payloads are truly coming from Eko.

To achieve this, Eko signs every webhook request with a client secret. This token is securely generated by Eko using a cryptographically secure random number generator and provided to you after you’ve created the webhook.

On every webhook request, Eko will use the client secret to create a HMAC signature of its payload. This hash signature is passed along with each request in the headers as X-Eko-Signature. The HMAC algorithm used is sha1 with the authorization token used as the HMAC key.

Delivery headers

HTTP POST payloads that are delivered to your webhook’s configured URL endpoint will contain several special headers

Header	Descriction
x-eko-signature	The HMAC hex digest of the response body. This header will be sent if the client menu is configured with a OAuth Client. The HMAC hex digest is generated using the SHA256 hash function and the Client Secret as the HMAC key.

Example header delivery

accept: application/json, text/plain, */*
content-length: 298
content-type: application/json;charset=utf-8
host: mock.domain.com
user-agent: axios/0.19.0
x-eko-signature: 0LJIIPckM3HzQnob15xXKzihN44fqC7Q45quVYctLTk=

How to verify signature

Example on Node.js

// 1. import crypto dependency for HMAC creating
const crypto = require('crypto');

// 2. use the client secret as the secret key
const CLIENT_SECRET = 'YOUR_CLIENT_SECRET';

// 3. convert request body to JSON string
const text = JSON.stringify(req.body);

// 4. generate the signature by HMAC-SHA256 algorithm using Client Secret and JSON string request body
const signature = crypto.createHmac('SHA256', CLIENT_SECRET).update(text).digest('base64').toString();

// 5. compare the signature and header's signature
if (signature !== req.headers['x-eko-signature']) {
    return res.status(401).send('Unauthorized');
}