Never Process a Spoofed Webhook
Hookbase verifies every incoming webhook signature at ingest — before the event is queued, transformed, or delivered anywhere. Dedicated verifiers ship for 11 named providers, and any other provider can use a generic HMAC check. A request that fails verification never enters the pipeline.
Verified Before Anything Else Happens
Signature verification is the first thing that runs when a request hits your ingest URL — not a step you remember to add later. See how the webhook relay works for the full pipeline; verification is step one of it.
Checked at Ingest
The signature is validated as the request arrives. Only requests that pass go on to be stored, routed, and delivered.
Spoofed Requests Stop Here
A forged request never becomes an event. It isn't queued, isn't transformed, and never reaches a destination.
Configured Per Source
Each Source is configured with a provider type, and verification is applied per Source — so a new integration is a dropdown choice, not new code.
Providers With Built-In Verification
Every provider below has a purpose-written signature verifier, matched to how that provider actually signs its requests. Pick the provider when you create the Source and verification is on.
GitHub
Signature checked on ingest, with the x-github-delivery header used as the deduplication key.
Stripe
Signature checked on ingest, with the event’s own id used as the deduplication key.
Shopify
Signature checked on ingest, with the x-shopify-webhook-id header used as the deduplication key.
Slack
Signature checked on ingest, with envelope_id or event_id used as the deduplication key.
Twilio
Signature checked on ingest, with x-twilio-message-sid or MessageSid used as the deduplication key.
SendGrid
Signature checked on ingest, with the x-message-id header used as the deduplication key.
Linear
Signature checked on ingest, with the linear-delivery header used as the deduplication key.
Vercel
Signature checked on ingest, with the x-vercel-id header used as the deduplication key.
Discord
A dedicated Discord verifier runs against every request before the event enters the pipeline.
Paddle
A dedicated Paddle verifier runs against every request before the event enters the pipeline.
GitLab
A dedicated GitLab verifier runs against every request before the event enters the pipeline.
Using something else? Any other provider can use the generic custom HMAC signature check, so you aren't limited to the list above. Browse all provider integrations for setup guides.
The Same Dispatcher Handles Duplicates
Providers retry their own deliveries, which means the same webhook can arrive more than once. The dispatcher that verifies the signature also extracts a provider-specific event ID, so a retried delivery isn't processed twice.
Provider Event IDs
GitHub uses x-github-delivery, Stripe uses the event's own id, Shopify uses x-shopify-webhook-id, and Slack uses envelope_id or event_id.
More Provider Headers
Twilio uses x-twilio-message-sid or MessageSid, SendGrid uses x-message-id, Linear uses linear-delivery, and Vercel uses x-vercel-id.
Custom Idempotency Keys
You can point at a custom idempotency header, or rely on the universal x-idempotency-key and idempotency-key headers.
Why This Matters
Signature verification looks like a few lines of code until you're maintaining a different implementation for every provider you integrate.
Rolling your own
Hookbase
Stop Maintaining HMAC Code
Create a Source, pick your provider, and every request is verified before it becomes an event. Get started free — no credit card required.
Start Free