Help CenterTo further increase the security of GlobalPass services, a V2 version of webhook delivery is introduced. The webhook secret is no longer exposed - it is used to generate the signature instead. In addition, webhook's headers now contain webhook's creation date.
Current webhook structure under V1:
Webhook structure under V2:
Update instructions:
To enable V2 webhooks version, turn on V2 Delivery toggle near your Webhook URL in Verification Settings:
New headers:
X-GP-Signature
A hash signature (HMAC-SHA-256) is added to the webhook headers. This is the HMAC hex digest of the request body, and is generated using the SHA-256 hash function and the Webhook secret as the HMAC key.
To validate a webhook, use the SHA-256 hash function and your Webhook Secret (generated and visible in the Portal when adding your Webhook URL) to generate hash signature of the webhook body. Then it can be compared with the signature in the headers.
X-GP-Created-At
This header contains date when the webhook was created. Using this date, webhooks can also be validated, for example, by ignoring webhooks which were created more than 15 minutes ago.