Webhook signatures - Tendr

Each webhook endpoint has its own signing secret (whsec_…), shown once when the endpoint is created and again when you rotate it. Every delivery carries a Tendr-Signature header:

Tendr-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(signing secret, "<t>.<raw body>")>

The timestamp is the t in this header; there is no separate timestamp header. For 24 hours after a secret rotation the header carries a second v1= signed with the old secret, so accept a match on any v1.

Verifying with the SDK

import { verifyWebhookSignature } from '@tendr/sdk/webhook';

const ok = verifyWebhookSignature({
  payload: rawBody, // the raw request body, not re-serialised JSON
  secret: endpointSigningSecret,
  signatureHeader: req.headers['tendr-signature'] as string,
});

Verifying by hand

Split the header on , and read t and every v1 value.
Compute HMAC-SHA256 of <t>.<raw body> with your signing secret, hex-encoded.
Compare it with each v1 using a constant-time comparison. Accept if any matches.
Reject the delivery if t is more than 5 minutes from your clock.

Verify before parsing or acting on the body. Deduplicate on the event id (also sent as Tendr-Event-Id), which stays the same on retries and resends.