---
updatedAt: 2024-12-18T19:33:15.000Z
agentTools:
  projectIndex: https://docs.riipen.com/llms.txt
---

# Signatures

Riipen will sign webhook events before sending a request to your endpoint. We include a signature in an `X-Riipen-Signature` header. This allows you to verify requests are coming from our servers. Verifying signatures is optional but highly recommended.

To verify a signature:

1. Extract the request payload (as a string)
2. Extract the expected signature from the `X-Riipen-Signature` header
3. Compute the actual signature (HMAC SHA-256 with your webhook secret token as the key and the string payload as message)
4. Compare the expected and actual signatures (use constant time comparison to prevent timing attacks)