Validating and Testing a Webhook

Before you start using a webhook, you must validate and test it.

Validating a Webhook

Once you set a secret token, PixelBin Platform uses it to generate a hash signature with each payload. A hash signature is calculated using HMAC with SHA256 algorithm; with your webhook secret as the key and the webhook request body as the message. This hash signature is included with the headers of each request as x-erbg-signature.

The value of x-erbg-signature header will be something like this:

c25736a50018dfc4da486456aee754cb6dad6621ff57aea13c65a50bd84c45c9

You can validate the webhook signature using an HMAC as shown below:

Node

const createHmac = require("crypto").createHmac;

const expectedSignature = createHmac('sha256', webhookSecret)
  .update(webhookBody) // raw webhook request body
  .digest('hex');

if (expectedSignature !== receivedSignature) {
    throw new Error();
}

Python

import hmac
import hashlib

key = webhook_secret
data = webhook_body

expected_signature = hmac.new(key.encode('utf8'), data.encode('utf8'), hashlib.sha256).digest()

if expected_signature != received_signature
    throw SecurityError
end

---

Testing a Webhook

Click the Test button to check if your webhook URL is valid. PixelBin Platform sends a ping event on the webhook URL.

It will show a success message if the URL is capable of receiving a payload from us.

Webhook Ping Event - Success Message

In case it shows a failure message, please verify your URL for any typo, and cross-check on your end if it's ready to receive any payload. Moreover, it should be a publicly accessible HTTPS URL.

Webhook Ping Event - Failure Message