WEBHOOKS
Signature verification
Verify HMAC signatures to ensure webhook payloads were sent by Mediloop and were not modified.
Real-time
Event driven
As events happen
Reliable delivery
Automatic retries
Exponential backoff
Signatures
HMAC SHA-256
Verify every payload
Endpoint limit
100 endpoints
Per tenant
Payload
JSON
Versioned envelope
Signature header
Headers
Mediloop-Signature: t=1787127330,v1=ab12...
Mediloop-Event-Id: evt_01J...Signing algorithm
Signatures use HMAC SHA-256 over the timestamp and raw request body with the endpoint secret.
Verification steps
| Step | Action |
|---|---|
| 1 | Read the raw request body |
| 2 | Parse timestamp + v1 signature |
| 3 | Build signed payload: timestamp.body |
| 4 | Compute HMAC SHA-256 with endpoint secret |
| 5 | Constant-time compare signatures |
| 6 | Reject timestamps outside tolerance |
Replay protection
Enforce a timestamp tolerance and store event IDs to prevent replay and duplicate processing.
Secret rotation
Support overlapping old/new secrets during a rotation window, then revoke the old secret after verification.
Code example
Node.js
const expected = crypto.createHmac('sha256', secret)
.update(timestamp + '.' + rawBody)
.digest('hex');
if (!timingSafeEqual(expected, signature)) throw new Error('invalid signature');Failure handling
Return 400/401 for invalid signatures. Do not process the event before verification succeeds.