Webhooks

Describe webhook HMAC verification

The HMAC scheme we sign with, the headers to read, and an example that verifies a payload. Read this before you write a receiver.

API key scopes: webhooks:read.

get/api/webhook-subscriptions/signature-guide

Request

  • Base URL: https://api.setluca.com
  • URL: https://api.setluca.com/api/webhook-subscriptions/signature-guide
  • Auth: one of:
    • API key in cookie luca.session_token
    • API key in header x-api-key
    • HTTP bearer

Headers

Luca-API-Version'1'

The major version of the API this client was built against. Omit it and the request is served by the current major version. Any other value is refused with 400 unsupported_api_version.

Response

ok

algorithm'HMAC-SHA256' required
signedPayloadFormat'timestamp.raw_body' required
signaturePrefix'v1=' required
digestEncoding'base64url' required
toleranceSecondsinteger required
duplicateHandlingstring required

Changes

No recorded changes to this operation across all 1 revision of this API.