Securing your webhook

Log in to Doczilla and grab your webhook secret key from the organizations settings page.

The x-doczilla-signature header is included in each webhook call containing a signature that you can verify.

Doczilla generates signatures using a hash-based message authentication code (HMAC) with SHA-256. To prevent downgrade attacks.

To verify your webhook simply re-create the signature with your webhook secret and the raw body.

See also Webhook event for the full event payload.

Examples