> ## Documentation Index
> Fetch the complete documentation index at: https://imprint-b3c5d5af-partner-docs-latest.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify event signature

> Secure transmission using the event signature header

Imprint provides signed webhooks to ensure authenticity and verify that the webhook requests originate from our servers. You'll receive a unique event signing token while enrolling in event notifications, and each event request includes a signature in the `X-IMPRINT-HMAC-SIGNATURE` header.

## Header Format

The `X-IMPRINT-HMAC-SIGNATURE` header is a comma-separated list of key/value pairs:

* **Timestamp (`t`)** – the time the request was sent, represented as seconds since January 1, 1970 (Unix epoch).

* **Signature (`s`)** – the cryptographic hash used to verify the request. The header carries **one `s` value per active signing token**, so during a token rotation you will receive more than one.

```plaintext theme={null}
t=1740779129,s=d3d12f37e9ccb686313322da672c3dbc19176d2bfbd29f987923b5784cd6ae7d
```

```plaintext During a signing token rotation theme={null}
t=1740779129,s=d3d12f37e9ccb686313322da672c3dbc19176d2bfbd29f987923b5784cd6ae7d,s=8a1c05f6b2e4d9370c85b1fa47de2c6039bb84e15d7c2a90f316e8b45c07d2ff
```

<Warning>
  Parse the header by splitting on commas and reading every `s` value — do not assume the header
  contains exactly one signature. A verifier that only checks the first `s` will begin rejecting
  valid events partway through a rotation.
</Warning>

## Verify signature

<Steps>
  <Step title="Extract the timestamp and signatures">
    * Split the `X-IMPRINT-HMAC-SIGNATURE` header on commas (`,`) into its key/value pairs.

    * Split each pair at the equals sign (`=`). Take `t` as the timestamp and collect **every** `s`
      value into a list — there may be more than one.
  </Step>

  <Step title="Construct the message to sign">
    * Concatenate the timestamp , a period (`.`), and the raw POST body as a string

    ```json theme={null}
    {"hello": "world", "amount": 5000}
    ```

    and the timestamp is `1723493048`, the message to sign would be:

    ```
    1723493048.{"amount":5000,"hello":"world"}
    ```
  </Step>

  <Step title="Compute the expected signature">
    * Use the signing token you were provided during event enrollment (hashed with SHA-256) to generate a Hash-based Message Authentication Code (HMAC).

    * Apply HMAC using the SHA-256 algorithm to the message created in Step 2.
  </Step>

  <Step title="Compare signatures">
    * Compare the computed signature with the `s` values from the `X-IMPRINT-HMAC-SIGNATURE` header. Use a constant-time comparison.&#x20;

    * If **any** `s` value matches, the request is authentic and was sent by Imprint.
  </Step>
</Steps>

<Info>
  The signature and its timestamp are recomputed on every delivery attempt, so a retry of an
  earlier event carries a current timestamp rather than the original one. Evaluate any freshness
  window per request, and never use the signature or timestamp as a deduplication key. See
  [Delivery and retries](/webhook-delivery-and-retries).
</Info>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.