Verifying webhook signatures

Every webhook request includes an InzoPay-Signature header with an HMAC-SHA256 signature. Always verify this to prevent spoofed requests.

Signature format

InzoPay-Signature: t=1713000000,v1=abc123def456...

Where t is the Unix timestamp and v1 is the HMAC-SHA256 of {timestamp}.{body}.

PHP verification example

$sigHeader = $_SERVER['HTTP_INZOPAY_SIGNATURE'];
$body      = file_get_contents('php://input');
$secret    = 'whsec_your_signing_secret';

[$tPart, $v1Part] = explode(',', $sigHeader);
$timestamp = substr($tPart, 2);
$received  = substr($v1Part, 3);

$expected = hash_hmac('sha256', $timestamp . '.' . $body, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(400);
    exit('Invalid signature');
}

// Request is authentic — process the event
$event = json_decode($body, true);

Replay protection

To prevent replay attacks, reject requests where the timestamp is more than 5 minutes old:

if (abs(time() - (int)$timestamp) > 300) {
    http_response_code(400);
    exit('Timestamp too old');
}