Webhook Identity Verification

Every webhook delivery from Cresora includes an HMAC-SHA256 signature. Verifying this signature confirms the delivery is from Cresora and hasn't been tampered with.

Why this matters

Without signature verification, any party who knows your webhook endpoint URL could send fake events and trigger unintended actions (e.g., fake payment.captured events to trigger order fulfillment).

Verification steps

1. Read the X-Cresora-Signature header: sha256=<hex>
2. Read the X-Cresora-Timestamp header: Unix timestamp
3. Reject if timestamp > 5 minutes old (prevents replay attacks)
4. Build the signing payload: <timestamp>.<raw_body>
5. Compute HMAC-SHA256(payload, signing_secret)
6. Compare to X-Cresora-Signature using constant-time comparison

See Signature Verification → for complete code examples in Node.js and Python.

The signing secret

Your endpoint's signing secret is generated when you register the endpoint in the Partner Portal. It is:

• Unique per endpoint (different endpoints have different secrets)
• Displayed only once — save it to your secrets manager immediately
• Rotatable in the Partner Portal without downtime (update your secret manager first, then rotate)

Source IP allowlisting (optional)

For defense-in-depth, you can allowlist Cresora's webhook source IP ranges. Contact your Cresora account manager for the current IP list.

Handling signature failures

If signature verification fails:

1. Log the failure with the raw headers (not the body — it may be malicious)
2. Return 400 Bad Request
3. Do not process the event
4. Alert your security team if failures persist — it may indicate an active attack