Hash / HMAC
A cryptographic signature used to verify that a webhook payload has not been tampered with in transit. Stripe, Shopify, and most platforms sign their webhooks with HMAC-SHA256. PURIST validates every signature before processing.
Expert insight
HMAC signatures are how most modern webhook providers (Stripe, Shopify, GitHub) let you verify a webhook actually came from them and wasn't forged, by signing the payload with a shared secret. A workflow accepting webhooks without verifying this signature will process a request from anyone who discovers the webhook URL, not just the real provider.
In a real workflow
An HMAC signature computed with a shared secret proves a webhook came from the expected sender and was not modified.
Common mistakes
- Comparing signatures with a non constant-time comparison.
- Using the wrong body encoding when computing the signature.
Complexity level
Technical term used in production automation systems.
Related terms
See it in action
Want Hash / HMAC built into your automation?
Book a free audit and we'll show you exactly how this applies to your business.
Get my free automation plan →Who we build for
Run a firm, an agency or an online store? We automate the work behind it.
Done-for-you n8n workflows and Claude AI agents, fixed price, maintained for you.
- Professional firms Onboarding, documents, billing and reporting run on their own. See what we automate →
- Agencies and SaaS teams Custom n8n and Claude builds, client reporting and internal tools. See what we automate →
- E-commerce brands Orders, support, returns and stock handled without the busywork. See what we automate →
More in Security
Keep exploring
Refresh token
A long-lived credential used to obtain new access tokens when they exp…
Secrets manager
A secure service for storing and retrieving sensitive credentials API …
Session management
Handling the lifecycle of authentication sessions in automation workfl…
Token refresh
Automatically obtaining a new access token before the current one expi…
Compliance automation
Using automation to enforce regulatory requirements continuously rathe…
Data masking
Replacing sensitive data fields with anonymised substitutes in non-pro…