WhatsApp Messaging API for Sending and Receiving Messages

How does HMAC webhook verification work?

An HMAC signature proves that a webhook request was created by someone who knows your shared secret. Because only Notivo and you know that secret, a valid signature tells you the request is genuine and was not changed on the way.

Verify every incoming webhook before you act on it:

• Read the raw request body exactly as it arrived, before any JSON parsing.
• Read the signature that Notivo sent with the request.
• Compute the HMAC of the raw body with your webhook secret.
• Compare both values with a constant-time comparison and reject the request if they differ.

The signature header name, hash algorithm and secret are shown in your dashboard and API documentation. Use those exact values in the example below.

<?php
$rawBody   = file_get_contents('php://input');
$received  = $_SERVER['HTTP_X_SIGNATURE'] ?? '';   // use the header name from your dashboard
$algorithm = 'sha256';                              // use the algorithm from your dashboard
$secret    = getenv('NOTIVO_WEBHOOK_SECRET');

$expected = hash_hmac($algorithm, $rawBody, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

$message = json_decode($rawBody, true);
// ...handle the customer reply