What is a webhook signature?
Quick answer
A webhook signature is a code the sending app attaches to each webhook request, usually in a header. The app makes it from the request body and a secret only you and the app know, typically with HMAC SHA-256. Your workflow makes the same code from the body and the secret; if the two match, the request is genuine and unchanged.
Last updated
Take the free module →Module 8 of the free Make & Zapier Jump Start course, about 12 minutes. No account needed.
Updated · By Robert Breen
Why it matters for a small business
A webhook address works like an unlocked door: anything sent to it runs your automation. If someone finds the address, they could send fake orders or fake form entries. A signature check lets your workflow ignore anything that did not come from the real app.
It also proves the data was not changed on the way. Payment, ecommerce and form apps such as Stripe and Shopify sign their webhooks for this reason, and their docs show which header to read. Where an app does not sign, the next best thing is a secret header or basic authentication on the webhook.
Where you'll use it: in the sending app's webhook settings, copy the signing secret into a saved credential. In n8n, the Webhook node offers Header Auth, Basic Auth and JWT; for an HMAC signature, a Crypto node can build the code from the raw body so an If node can compare it with the header.
In a real lesson: Webhooks: Connect a Website Form to Make.com
In the free Webhooks: Connect a Website Form to Make lesson, Brookside Dental's site form posts each request to a Make custom webhook. You leave API Key authentication empty, and the lesson tells you to treat the webhook address like a password, because anything sent to it runs your scenario.
A webhook signature is the stronger version of that care. If the form tool signed its requests, the scenario could check the signature first and drop any request that does not match, so a leaked address could not fill the sheet with fake patients.
Try this lesson free or read the step-by-step guide.
Common confusions
Webhook signature vs API key
An API key proves who is calling an API. A signature proves a webhook you received came from the app and was not changed.
Signature vs test and production URLs
Separate test and production URLs keep tests apart from live runs. They are not a security check.
Tips
- Keep the signing secret in a credential, never in a note or a sheet.
- Check the signature against the raw body, before any reformatting.
- Reject old requests too if the app sends a timestamp.
Related terms
More n8n and automation terms
Where you use it: free lessons
- Webhooks: Connect a Website Form to Make.com (Make, 12 min)
- What Is a Webhook? Send a Test and Watch the Data Arrive (Webhook.site, 6 min)
- Webhooks and Forms in n8n: Capture Data from Anywhere (n8n, 12 min)
- Guardian: Make Your n8n AI Agent Ask Before It Emails a Customer (Guardian, 14 min)
Frequently asked questions
- Do all apps sign their webhooks?
- No. Many payment and ecommerce apps do; simple form tools often do not. Check the app's webhook docs.
- What is HMAC?
- A standard way to make a code from a message and a secret key. Anyone with the same key can make the same code and compare.