Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUse the signature scheme your webhook provider documents. HMAC-SHA256 is a common, straightforward option, but the sender and receiver both hold the signing secret. With a public-key scheme such as Ed25519, the sender signs with a private key and the receiver verifies with a public key, so webhook consumers do not need the signing secret. Either way, verify the exact request bytes and signed metadata, and add replay and duplicate-delivery controls: a valid signature alone does not make a request fresh.
What changes between HMAC and a public-key signature?
HMAC is symmetric: the sender and receiver share a secret used to create and verify the message authentication code. That makes setup relatively simple, but any system that holds the secret can also produce a valid MAC. If a receiver’s secret is compromised, an attacker may be able to forge messages that pass verification.
As an Amazon Associate I earn from qualifying purchases.
In an asymmetric scheme, the sender signs with its private key and the receiver checks the signature with the corresponding public key. A receiver that has only the public key can verify deliveries but cannot create signatures. This reduces the need to distribute signing secrets to consumers; it does not eliminate the need to protect the sender’s private key or to obtain the public key through an authentic channel.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Decision factor | HMAC shared secret | Public-key signature |
|---|---|---|
| Key distribution | Sender and receiver both need the secret. | Sender keeps the private key; receiver needs the public key. |
| Who can create a valid signature? | Every holder of the shared secret. | The holder of the private key; a receiver with only the public key cannot sign. |
| Operational setup | Simple and widely available when the provider supports it. | Requires a matching key pair and a maintained verification library. |
| Performance | Svix describes symmetric signing as faster in its own implementation; this is not a general benchmark. | Svix describes asymmetric operations as more CPU-intensive in its own implementation; this is not a general benchmark. |
| When it may fit | When distributing and protecting a shared secret is manageable. | When consumers should verify without receiving a signing secret, or the trust boundary favors public verification. |
The Standard Webhooks specification gives HMAC-SHA256 and Ed25519 as examples of symmetric and asymmetric methods. Its described symmetric secrets are random values of 24–64 bytes; that and its key formats are specification-specific, not universal requirements for every provider.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to verify a webhook safely
- Follow the provider’s verification contract. Use its official instructions or SDK, and confirm the algorithm, header names, key encoding, and exact message construction. Implementations are not interchangeable merely because they all use HMAC or public-key cryptography.
- Keep the raw body bytes. Verify the request body exactly as received, along with every required signed metadata field. Do not parse JSON and serialize it again before verification; whitespace or encoding changes can alter the bytes. The Standard Webhooks specification and Svix’s Ruby receiving guide cover raw-body handling.
- For HMAC, compare safely. Calculate the expected MAC using the documented secret and use a constant-time comparison function. Avoid ordinary string equality if it exits early on the first differing character and the platform provides a timing-safe alternative.
- For public-key verification, use a maintained cryptographic library. Validate the signature with the provider’s specified algorithm, and establish that the public key came from an authentic provider channel.
- Check freshness and uniqueness. If the provider signs a timestamp, reject deliveries outside an appropriate tolerance. Record a delivery or event ID and make downstream work idempotent so retries or captured requests do not cause the same business action twice.
- Acknowledge only after durable acceptance. Return the response expected by the provider after the event has been durably accepted, and account for its documented retry behavior. A retry may be another delivery attempt for the same business event.
Why a valid signature does not prevent replay
A signature establishes that the signed content and metadata match a key; it does not, by itself, prove that the request has not been seen before or is recent. An attacker who captures a valid request may replay it, and providers may also send retries when acknowledgments fail.
Use signed timestamps to apply a freshness window when the format supports them, and persist unique delivery or event IDs to prevent duplicate processing. Keep the distinction clear in application logic: delivery identity helps recognize repeated deliveries, while idempotency protects the business operation if the same event is received more than once.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Provider formats are not interchangeable
GitHub webhooks
GitHub recommends validating the payload with X-Hub-Signature-256, which uses HMAC-SHA256 and the configured webhook secret. Its best-practices guidance recommends X-GitHub-Delivery as a unique delivery identifier to help prevent a replayed delivery from being processed more than once. See GitHub’s guides to validating webhook deliveries and webhook best practices. These cited GitHub pages describe HMAC validation; they do not describe Ed25519 as a webhook-signature option.
Recommended Free Tools
Standard Webhooks and Svix
The Standard Webhooks specification describes the webhook-id, webhook-timestamp, and webhook-signature headers. Its examples include HMAC-SHA256 (v1) and Ed25519 (v1a), recommend timestamp freshness checks, and use the unique ID as an idempotency key. The specification also describes sending signatures for old and new keys during an overlap period to support rotation. Svix says its implementation supports symmetric and asymmetric schemes and describes symmetric signing as its default; that is Svix’s implementation choice, not a universal recommendation. See the Svix webhook repository README.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Plan rotation, retries, and key compromise
Key rotation is part of operating the integration, not a change to make casually in application code. Follow the provider’s documented overlap and retry behavior. Where the format supports overlapping keys, accept both the old and new keys for the specified transition period, then retire the old key. If a key is compromised, replace it promptly and assess whether forged or replayed events could have triggered downstream actions.
For HMAC, protect the shared secret anywhere it is stored or deployed because each holder can generate valid MACs. For public-key verification, protect the signing private key and manage the authenticity and distribution of public keys. Neither scheme removes the need for durable event handling and idempotency.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
