Verify signatures

Every delivery is signed. Check the signature before you trust the body; anyone can post to your URL.

How it's signed

X-Inkress-Webhook-Signature is the HMAC-SHA256 of the raw request body, keyed with the signing secret and base64 encoded.

Endpoint	Signing secret
Added by a merchant or for one	That merchant's client secret, from API keys.
Registered by an app	The app's webhook secret, `whsec_…`, from the app's page.

Check it

Read the raw body before any JSON parser touches it. Re-encoding changes the bytes.
Compute the HMAC-SHA256 with your secret, base64 encode it, and compare with the header in constant time.
Reject the request with 400 if they differ.

With the Node SDK (1.1.52), inkress.webhookUrls.verify(body, signature, secret) does the comparison and throws when it fails.

PreviousEvent types NextRun merchants

Was this page helpful?Updated Oct 8, 2026

import express from "express"; import { InkressSDK } from "@inkress/admin-sdk"; const inkress = new InkressSDK({ accessToken: "YOUR_TEST_KEY", mode: "sandbox" }); const app = express(); // Keep the raw body: the signature covers the exact bytes we sent. app.post("/hooks/inkress", express.raw({ type: "application/json" }), async (req, res) => { const body = req.body.toString("utf8"); try { await inkress.webhookUrls.verify( body, req.get("X-Inkress-Webhook-Signature") ?? "", process.env.INKRESS_WEBHOOK_SECRET, ); } catch { return res.status(400).send("bad signature"); } const event = JSON.parse(body); if (event.event === "orders.paid") await markPaid(event.order.reference); res.sendStatus(200); });