> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infinitecreator.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How to verify the signature of a webhook to ensure it's from Infinite Creator.

Infinite Creator webhooks are sent with a signature the destination server can use to verify that the event came from Infinite Creator and not a third party or malicious system. It is strongly recommended that webhook consumers verify these signatures before processing each webhook event.

## Verify Message Signature

To protect your app against man-in-the-middle and replay attacks, you should verify the signature of messages sent to your application.

The signature is included as an `InfiniteCreator-Signature` header:

`InfiniteCreator-Signature: t=1633174587,s=18494715036ac4416a1d0a673871a2edbcfc94d94bd88ccd2c5ec9b3425afe66`

A replay attack is when an attacker intercepts a valid payload and its signature, then re-transmits them. To mitigate such attacks, we include a timestamp in the `InfiniteCreator-Signature` header. Because this timestamp is part of the signed payload, it’s also verified by the signature, so an attacker can’t change the timestamp without invalidating the signature. If the signature is valid but the timestamp is too old, you can have your application reject the payload.

Infinite Creator generates the timestamp and signature each time we send an event to your endpoint. If Infinite Creator retries an event (for example, your endpoint previously replied with a non-2xx status code), then we generate a new signature and timestamp for the new delivery attempt.

## Examples

<CodeGroup dropdown>
  ```python theme={null}
  import hashlib
  import hmac

  def verify_signature(t: str, s: str, request_body: str, secret: str) -> bool:
      signed_payload = t + '.' + request_body
      signature = hmac.new(key=secret.encode(), msg=signed_payload.encode(), digestmod=hashlib.sha256).hexdigest()
      return hmac.compare_digest(signature, s)
  ```
</CodeGroup>

## Verification steps

<Steps>
  <Step title="Obtain the timestamp and signature from the header">
    Split the header, using the `,` character as the separator, to get a list of elements. Next, split each element, using the `=` character as the separator, to get a prefix and value pair.

    The value for the prefix `t` corresponds to the timestamp, and `s` corresponds to the signature.
  </Step>

  <Step title="Calculate your own signature">
    Create `signed_payload` by concatenating:

    * The timestamp `t` as a string
    * The character `.`
    * The actual JSON payload (request body)

    An HMAC with the SHA256 hash function is computed with your <Tooltip tip="Issued to you upon registering a webhook">signing secret</Tooltip>
    as the key and your `signed_payload` string as the message.
  </Step>

  <Step title="Compare the signatures">
    Compare the signature in the header to the signature you generated. In the case they are equal, compute the difference between the current timestamp and the received timestamp in the header. Use this to decide whether the difference is tolerable.

    Use Network Time Protocol (NTP) to make sure that your server's clock is accurate. To protect against timing attacks, use a constant-time string comparison function.
  </Step>
</Steps>