---
title: "Describe webhook HMAC verification"
method: GET
path: "/api/webhook-subscriptions/signature-guide"
tags: ["Webhooks"]
---

# Describe webhook HMAC verification

`GET /api/webhook-subscriptions/signature-guide`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/webhook-subscriptions/signature-guide`
- Auth: one of:
  - API key in cookie `luca.session_token`
  - API key in header `x-api-key`
  - HTTP bearer

The HMAC scheme we sign with, the headers to read, and an example that verifies a payload. Read this before you write a receiver.

**API key scopes:** `webhooks:read`.

## Headers

- `Luca-API-Version` '1'

## Response `200`

ok

- WebhookSignatureGuide
  - `algorithm` 'HMAC-SHA256', required
  - `signedPayloadFormat` 'timestamp.raw_body', required
  - `signaturePrefix` 'v1=', required
  - `digestEncoding` 'base64url', required
  - `toleranceSeconds` integer, required
  - `headers` object, required
    - `eventId` 'x-luca-event-id', required
    - `deliveryId` 'x-luca-delivery-id', required
    - `timestamp` 'x-luca-timestamp', required
    - `signature` 'x-luca-signature', required
  - `duplicateHandling` string, required

## Other responses

- `401`: unauthorized
- `429`: rate limited

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)