> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leamout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify webhooks

> Verify Leamout webhook signatures using the timestamp and raw request body.

Leamout signs webhook deliveries with HMAC-SHA256.

Each delivery includes these headers:

```http theme={null}
X-Leamout-Event: call.answered
X-Leamout-Event-ID: <event UUID>
X-Leamout-Timestamp: 1789243200
X-Leamout-Signature: v1=<hex digest>
```

To verify a delivery:

1. Read `X-Leamout-Timestamp` as the Unix timestamp Leamout used when signing.
2. Keep the request body as the exact raw bytes received.
3. Construct `<timestamp>.<raw body>`.
4. Compute HMAC-SHA256 using the webhook endpoint's signing secret.
5. Hex-encode the digest and prefix it with `v1=`.
6. Compare your value with `X-Leamout-Signature` using a constant-time comparison.

```text theme={null}
signed_payload = X-Leamout-Timestamp + "." + raw_body
expected = "v1=" + hex(HMAC-SHA256(signing_secret, signed_payload))
```

<Warning>
  Verify the raw body before parsing or re-serializing JSON. Byte-level changes produce a different signature.
</Warning>

The webhook signing secret is returned when an endpoint is created or its secret is rotated. Store it as a secret and replace it when you rotate the endpoint secret.