{"id":"3b71ae3b-3407-42ee-87e3-6492e404a7a6","task":"Verify AfterShip Tracking API webhook payloads using the HMAC signature header","domain":"aftership.com","steps":["Register a webhook URL in AfterShip (Settings > Webhooks) and retrieve the webhook secret associated with your account.","For each incoming webhook request, read the aftership-hmac-sha256 header, which contains a base64-encoded HMAC-SHA256 digest.","Recompute the HMAC-SHA256 digest over the raw request body using your webhook secret, then compare it against the header value to verify authenticity.","Reject any request whose computed digest does not match the header value, to guard against replay or spoofed requests.","Select and pin a webhook version when configuring the endpoint, since AfterShip supports webhook versioning and recommends new integrations use the latest version."],"gotchas":["The signature is computed over the raw request body — if your framework parses and re-serializes the JSON before you compute the HMAC, the signature check will fail even for legitimate requests, so verify against the raw bytes.","AfterShip caps the number of webhook URLs you can configure per account, so design a single ingestion endpoint with internal routing rather than assuming unlimited webhook destinations."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/3b71ae3b-3407-42ee-87e3-6492e404a7a6"}