> For the complete documentation index, see [llms.txt](https://docs.amitysolutions.com/ekoai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.amitysolutions.com/ekoai/getting-started/eko/webhook-authorization.md).

# Webhook Authorization

Once your server is configured to receive webhook payloads, it’ll listen for any payload sent to the URL you configured. For security reasons, you probably want to verify that the payloads are truly coming from Eko. 

To achieve this, Eko signs every webhook request with a client secret. This token is securely generated by Eko using a cryptographically secure random number generator and provided to you after you’ve created the webhook.

On every webhook request, Eko will use the client secret to create a **HMAC signature** of its payload. This hash signature is passed along with each request in the headers as **X-Eko-Signatur**e. The HMAC algorithm used is sha1 with the authorization token used as the HMAC key.

#### Delivery headers

HTTP POST payloads that are delivered to your webhook's configured URL endpoint will contain several special headers

<table><thead><tr><th width="166.5859375">Header</th><th>Descriction</th></tr></thead><tbody><tr><td><strong>x-eko-signature</strong></td><td>The HMAC hex digest of the response body. This header will be sent if the client menu is configured with a <code>OAuth Client</code>. The HMAC hex digest is generated using the <code>SHA256</code> hash function and the <code>Client Secret</code> as the HMAC <code>key</code>.</td></tr></tbody></table>

**Example header delivery**

```
accept: application/json, text/plain, */*
content-length: 298
content-type: application/json;charset=utf-8
host: mock.domain.com
user-agent: axios/0.19.0
x-eko-signature: 0LJIIPckM3HzQnob15xXKzihN44fqC7Q45quVYctLTk=
```

#### How to verify signature

Example on Node.js

```
// 1. import crypto dependency for HMAC creating
const crypto = require('crypto');

// 2. use the client secret as the secret key
const CLIENT_SECRET = 'YOUR_CLIENT_SECRET';

// 3. convert request body to JSON string
const text = JSON.stringify(req.body);

// 4. generate the signature by HMAC-SHA256 algorithm using Client Secret and JSON string request body
const signature = crypto.createHmac('SHA256', CLIENT_SECRET).update(text).digest('base64').toString();

// 5. compare the signature and header's signature
if (signature !== req.headers['x-eko-signature']) {
    return res.status(401).send('Unauthorized');
}
```

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.amitysolutions.com/ekoai/getting-started/eko/webhook-authorization.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.