# How to verify odiggo webhook signature?

odiggo.xyz · November 8, 2026

> Understanding Webhook Security Requirements To verify the odiggo webhook signature, you must first extract the signature header from the incoming HTTP...

## Understanding Webhook Security Requirements

To verify the odiggo webhook signature, you must first extract the signature header from the incoming HTTP request. Odiggo typically includes this cryptographic hash in a specific header, such as X-Odiggo-Signature or a similar custom field. Your application should then retrieve the raw request body, ensuring that no transformations or parsing have altered the original byte sequence. It is crucial to use the exact payload received, as any modification will result in a mismatch during the verification process. This raw data serves as the input for your cryptographic verification function, which must align with the algorithm specified in your integration documentation, often HMAC-SHA256 or similar standards.

**Also worth reading:** [What are the odiggo api rate limits?](https://odiggo.xyz/knowledge/what_are_the_odiggo_api_rate_limits.php) · [How does Odiggo pricing compare to competitors?](https://odiggo.xyz/knowledge/how_does_odiggo_pricing_compare_to_competitors.php) · [What are Odiggo fleet management pricing tiers?](https://odiggo.xyz/knowledge/what_are_odiggo_fleet_management_pricing_tiers.php)

Once you have the raw body and the signature, compute the hash using your secret key, which you obtained during the webhook setup in the Odiggo dashboard. Compare the computed hash against the received signature using a constant-time comparison function to prevent timing attacks. If the values match exactly, the webhook is authentic and originated from Odiggo’s servers. If they differ, reject the request immediately to prevent unauthorized data injection. This rigorous verification ensures that only legitimate events trigger your internal business logic, maintaining data integrity for your fleet management operations. Always store your secret keys securely and rotate them periodically to enhance overall security posture for your B2B SaaS integration.

## Extracting Signature Header Values

To settle the extraction step, treat Odiggo's webhook signature header as a structured timestamp-plus-signature value rather than a bare hash. Read X-Odiggo-Signature, split on commas, then split each pair on the first equals sign; keep t as the Unix timestamp and every v1 as candidate HMAC-SHA256 signatures. Preserve the exact raw request body before JSON parsing, because any reserialization changes bytes and invalidates comparison. If the header is absent or lacks t and at least one v1, reject the delivery.

Verification then becomes deterministic: construct the signed payload as the timestamp, a literal dot, and the raw body; compute HMAC-SHA256 with the endpoint's signing secret; compare each candidate v1 in constant time. Accept only if one matches and the timestamp is within your replay window, typically five minutes. This settles header extraction and leaves only key rotation and clock-skew policy as deployment choices.

## Constructing Canonical Payload String

The first step in verifying an Odiggo webhook signature is building the exact string that was signed on the server side. This canonical payload is typically formed by concatenating the request timestamp, a period delimiter, and the raw request body exactly as received. The critical requirement here is using the untouched, byte-for-byte body rather than a re-serialized version of the parsed JSON, because key ordering or whitespace differences will silently break the comparison.

Retrieve the timestamp and signature from the webhook headers, then append the raw body to the timestamp with no extra separators or trimming. Compute an HMAC-SHA256 of this concatenated string using your shared webhook signing secret from the Odiggo dashboard, and compare the result to the delivered signature. It is also wise to reject requests where the timestamp falls outside a small tolerance window, since this defends against replay attacks where an old, valid payload is resubmitted.

## Computing HMAC SHA256 Hash

To verify an Odiggo webhook signature, take the raw request body exactly as received—before any parsing or re-serialization—and compute an HMAC using SHA256 with your webhook signing secret as the key. The signing secret is provided in the Odiggo dashboard when you create or view a webhook endpoint. Compute the digest over the UTF-8 encoded body bytes, then compare the resulting hex-encoded output against the value in the X-Odiggo-Signature header. Use a constant-time comparison function, such as hmac.compare_digest in Python or crypto.timingSafeEqual in Node.js, to prevent timing attacks.

The most common failure point is body mutation: frameworks like Express that parse JSON automatically will alter whitespace and key ordering, breaking the hash. Capture the raw body with middleware before parsing, and verify the signature before trusting the payload. If signatures still fail, confirm you are using the endpoint-specific secret rather than an account-level key, and check that no proxy or gateway is modifying the body in transit.

## Comparing Hashes For Validation

For Odiggo webhooks, the reliable validation step is to compute the HMAC-SHA256 digest over the exact raw request body using the shared signing secret, then encode the digest as lowercase hexadecimal. Use the unparsed bytes as received; re-serializing JSON or changing whitespace will alter the digest and cause false failures. If the signature header includes a version or timestamp prefix, strip only the documented prefix before comparison, but never transform the payload.

The remaining decision is how to compare the computed digest with the supplied signature. Do not use ordinary string equality. Decode the provided hexadecimal signature into bytes and compare it with the computed digest using a constant-time equality function. Reject the request when lengths differ, when decoding fails, or when the comparison returns false. Treat that check as the only source of signature validity rather than trusting parsed payload fields. This settles the validation method: raw-body HMAC-SHA256, lowercase hex, constant-time byte comparison.

## Verification Method Comparison

| Method | Complexity | Security Level | Recommended For |
| --- | --- | --- | --- |
| HMAC-SHA256 | Low | High | Standard API integrations |
| JWT Bearer | Medium | High | Token-based authentication flows |
| Custom Header | High | Medium | Legacy system compatibility |

Odiggo utilizes HMAC-SHA256 for robust webhook verification, ensuring data integrity through cryptographic signatures. Developers must compute the hash using their secret key against the raw request body. This method prevents unauthorized modifications and guarantees that incoming events originate directly from Odiggo’s infrastructure, maintaining secure B2B fleet operations without exposing sensitive credentials.

## Quick answers

### What algorithm does Odiggo use for signatures?

Odiggo uses HMAC-SHA256 to generate the signature header.

### Where is the signature located in the request?

The signature is typically found in the X-Odiggo-Signature header.

### How do I handle the payload for verification?

You must use the exact raw body sent in the request.

### What happens if the signature does not match?

The webhook should be rejected to prevent unauthorized data processing.

Canonical: https://odiggo.xyz/knowledge/how_to_verify_odiggo_webhook_signature.php
Markdown: https://odiggo.xyz/knowledge/how_to_verify_odiggo_webhook_signature.php/index.md