Why Verify Signatures?
Without cryptographic signature verification, malicious actors could forge HTTP POST requests directly to your webhook endpoints, claiming that a customer completed a payment.
Bunnylynk verifies HMAC signatures on the edge before saving the event. If the signature is invalid or forged, Bunnylynk rejects the request immediately with 401 Unauthorized and logs the security attempt.
Provider-Specific Verification
Stripe
Stripe includes a Stripe-Signature header containing a timestamp t and signature v1:
HMAC-SHA256(signing_secret, t + "." + raw_body)
Bunnylynk automatically verifies the hash and enforces a 300-second maximum clock skew window to prevent replay attacks.
Shopify
Shopify sends X-Shopify-Hmac-Sha256, which is a base64-encoded HMAC-SHA256 hash of the raw payload signed with your Shopify app secret.
GitHub
GitHub sends X-Hub-Signature-256, formatted as sha256=<hex_digest>.
Forwarding Signed Webhooks to Destinations
When Bunnylynk forwards an event to your internal Destination endpoint, it can generate a brand-new cryptographic signature using your own internal shared secret:
X-Bunnylynk-Signature: t=1614552000,v1=5d2c75aef2f...
This guarantees to your internal microservice that the webhook passed through Bunnylynk's validated gateway.
Next: Review the REST API Reference.