> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allocait.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify deliveries

> Check the signature on each webhook delivery.

Check the `X-Allocait-Signature` header on every delivery before you trust the payload. The signing secret is the one Allocait showed when you added the endpoint.

## Check the signature

Every request carries an `X-Allocait-Signature` header:

```
X-Allocait-Signature: sha256=<hex-digest>
```

The digest is `HMAC-SHA256(secret, raw_body)`, computed over the exact bytes of the request body with the secret you saved. Compare it with a constant-time check such as `timingSafeEqual`, not `===`, before you trust the payload. Each request is a `POST` with `Content-Type: application/json`.

```js Node.js theme={null}
import crypto from 'node:crypto'

function verify(raw, header, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(raw)
    .digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(header ?? '')
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}
```

`timingSafeEqual` throws when the two buffers differ in length, so the sample compares lengths first and treats a missing header as empty.

Reject a delivery whose `timestamp` is more than 5 minutes old. The timestamp is inside the signed body, so a copied old delivery still has a valid signature.

> [!NOTE]
>
> A webhook reports state against your own rules: a rule's status changed against your bands, or a monitor's close met a level you set. It isn't a recommendation, and nothing in it is an instruction to trade.

## Next steps

> [card] [Webhook events](https://docs.allocait.app/api/webhook-events.md)
>
> The fields in each payload.

> [card] [Webhooks](https://docs.allocait.app/guides/webhooks.md)
>
> Set up an endpoint and see how retries work.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.