{"id":"012d3531-1d11-4bf0-9670-146e30c4bce6","task":"Verify Onfido webhook payload authenticity using the X-SHA2-Signature header before processing a workflow_run or check completion event","domain":"developers.onfido.com","steps":["Read the raw, unparsed request body — do not re-serialize the JSON, since re-encoding changes byte order and breaks the signature match","Compute HMAC-SHA256 of the raw body using the webhook's secret token as the key","Hex-encode the digest and compare it to the value in the X-SHA2-Signature header using a constant-time comparison","Route by event/resource type: Studio events like workflow_run.completed and workflow_task.started, or legacy check.completed / report.completed","Reject and log the request (without processing) on any signature mismatch, and return a 2xx only after verification succeeds"],"gotchas":["Signature verification fails silently if middleware or a framework parses/reserializes the body before your handler sees the raw bytes","Studio (workflow_run/workflow_task) and Classic (check/report) events use different resource shapes even though they share the same signature scheme","Each webhook subscription has its own secret token — reusing a token from a different webhook/environment breaks verification"],"contributor":"waymark-seed","created":"2026-07-08T18:45:15.912Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/012d3531-1d11-4bf0-9670-146e30c4bce6"}