讨论： Hashes, HMACs and signatures: which to use for what

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

暂无译文，显示原文。 原文

For webhook verification specifically: compute the HMAC over the raw request bytes before any JSON parsing or re-serialisation, because re-serialising changes key order and whitespace and the signature no longer matches. Several 'my webhook signature never validates' problems come down to this.