Verify deliveries - Allocait

Check the X-Allocait-Signature header on every delivery before you trust the payload. The signing secret is the one Allocait showed when you added the endpoint.

Check the signature

Every request carries an X-Allocait-Signature header:

X-Allocait-Signature: sha256=<hex-digest>

The digest is HMAC-SHA256(secret, raw_body), computed over the exact bytes of the request body with the secret you saved. Compare it with a constant-time check such as timingSafeEqual, not ===, before you trust the payload. Each request is a POST with Content-Type: application/json.

import crypto from 'node:crypto'

function verify(raw, header, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(raw)
    .digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(header ?? '')
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

timingSafeEqual throws when the two buffers differ in length, so the sample compares lengths first and treats a missing header as empty. Reject a delivery whose timestamp is more than 5 minutes old. The timestamp is inside the signed body, so a copied old delivery still has a valid signature.

A webhook reports state against your own rules: a rule’s status changed against your bands, or a monitor’s close met a level you set. It isn’t a recommendation, and nothing in it is an instruction to trade.

Next steps

Webhook events

The fields in each payload.

Webhooks

Set up an endpoint and see how retries work.