Signatures

Webhook signatures use HMAC-SHA256 over raw request body.

Headers

X-Polynion-Event-Id: evt_...
X-Polynion-Timestamp: 2026-06-18T00:00:00.000Z
X-Polynion-Signature: v1=...

Signing string

{timestamp}.{raw_body}

Signature format

v1={hex_hmac_sha256(secret, signing_string)}

Receiver requirements

• Use raw request body bytes.
• Verify signature before parsing business payload.
• Reject unsupported signature version.
• Reject timestamp skew greater than 5 minutes.
• Reject duplicate event_id already processed.

Minimum verification flow

1. Read raw body.
2. Read timestamp and signature headers.
3. Build signing string.
4. Compute HMAC with webhook secret.
5. Constant-time compare against provided signature.
6. Check timestamp skew.
7. Check replay store for duplicate event_id.
8. Only then process event.