Verify a webhook (signature)

Every webhook message is signed, so you can prove it comes from DanskAdresseAPI and isn't forged.

When you create a webhook, you get a secret key that starts with whsec_. It's shown only once. Here's how your server verifies a message:

1. Read the X-Addr-Signature header. It looks like this: t=1727690000,v1=5f2c… — t is a Unix timestamp, v1 is the signature.
2. Compute an HMAC-SHA256 (hex) of the string t + . + the raw request body yourself, using your whole secret (including whsec_) as the key.
3. Compare your computed value with v1 from the header — use a constant-time comparison (e.g. timingSafeEqual).
4. If they match, the message is genuine. Otherwise: reject it. It's a good idea to also check that t is recent, so old messages can't be replayed.

Store your secret safely (like a key), and always reject messages whose signature doesn't match. If you lose it, you'll need to create a new webhook. You'll find a code example under Verify the signature on the Webhooks page.