> ## Documentation Index
> Fetch the complete documentation index at: https://leadping.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Validating Webhooks

> Optionally verify signed Leadping automation webhooks and safely handle retries.

Leadping uses the [Standard Webhooks](https://www.standardwebhooks.com/) specification to sign automation webhook deliveries. This means your endpoint can use an existing Standard Webhooks-compatible library to verify that a request came from Leadping and was not changed in transit; you do not need a Leadping-specific verifier.

Signature validation is optional. To use it, configure the Leadping **Webhooks** connection with the `signature` authentication mode and a signing secret in this format:

```text theme={null}
whsec_<base64-encoded secret>
```

The decoded secret must be between 24 and 64 bytes. Store it in your secret manager and do not include it in source code, logs, URLs, or webhook payloads.

When another authentication mode is selected, such as `bearer`, `header`, or `none`, Leadping does not add the signature headers described on this page.

## Signature headers

Signed deliveries follow the Standard Webhooks signing format:

| Header              | Description                                                                                             |
| ------------------- | ------------------------------------------------------------------------------------------------------- |
| `webhook-id`        | Stable identifier for the automation action run. Retries use the same value.                            |
| `webhook-timestamp` | Unix timestamp, in seconds, for this delivery attempt.                                                  |
| `webhook-signature` | A signature in `v1,<base64 signature>` format. The format supports multiple space-separated signatures. |

Leadping calculates each `v1` signature with HMAC-SHA256 over:

```text theme={null}
{webhook-id}.{webhook-timestamp}.{raw request body}
```

The signing key is the Base64-decoded portion of the `whsec_` secret.

## Validation steps

Validate a signed request before parsing or otherwise processing its body:

1. Read the three signature headers.
2. Reject a timestamp outside a short tolerance, such as five minutes.
3. Build the signed content from the header values and the exact raw request-body bytes.
4. Base64-decode the key after removing the `whsec_` prefix.
5. Calculate HMAC-SHA256 and compare it with every supported `v1` signature using a constant-time comparison.
6. Reject the request unless at least one signature matches.
7. Deduplicate successful deliveries by `webhook-id` before performing side effects.

<Warning>
  Do not deserialize the JSON and serialize it again before validation. Changes to whitespace, escaping, property order, or character encoding produce a different signature.
</Warning>

## Use a Standard Webhooks library

The Standard Webhooks project maintains reference verification libraries with installation instructions and code samples for C#, JavaScript and TypeScript, Python, Java and Kotlin, Go, PHP, Ruby, Rust, and Elixir:

* [Browse the Standard Webhooks reference libraries](https://www.standardwebhooks.com/)
* [View the reference implementations and package names](https://github.com/standard-webhooks/standard-webhooks#reference-implementations)
* [Read the signature-verification specification](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md#verifying-signatures)

Use the symmetric HMAC-SHA256 verifier from the library for your language. Pass it:

* The `whsec_` signing secret configured in Leadping
* The exact, unmodified request body
* The `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers

The library should perform the HMAC comparison and timestamp validation. Configure a short timestamp tolerance, such as five minutes, when the library exposes that option.

Return `401 Unauthorized` or `400 Bad Request` without processing the payload when verification fails. Return a successful `2xx` response only after the delivery has been accepted for processing.

## Retries and replay protection

Leadping may retry a webhook when an attempt fails. Retries keep the same `webhook-id`, but each attempt receives a current `webhook-timestamp` and a new signature.

Store successfully processed `webhook-id` values for an appropriate period and make processing idempotent. Timestamp validation limits how long a captured request can be replayed; deduplication prevents a valid retry from applying the same operation twice.

The Standard Webhooks format allows multiple space-separated signatures. Check every supported `v1` entry and ignore signature versions your endpoint does not support.

***

*Last updated: July 27, 2026*