{"id":"730c9919-9111-4c0c-9a54-be65c4b32fd6","task":"Verify a Veriff webhook or session API response using the X-HMAC-SIGNATURE header before trusting the decision payload","domain":"devdocs.veriff.com","steps":["For webhooks, take the raw request body; for signed GET requests, take the session ID as the signed content","Compute HMAC-SHA256 over that content using your shared secret key, and hex-encode the result","Compare the computed digest to the incoming X-HMAC-SIGNATURE header value with a constant-time comparison","Also confirm the X-AUTH-CLIENT header matches your issued API key before processing further","Only after both checks pass, parse the decision/status payload and update your onboarding record"],"gotchas":["The signed content differs by endpoint type — session GET requests sign the session ID itself, while webhooks sign the raw POST body, so reusing one signing routine for both will fail","Any JSON re-serialization or whitespace change to the raw webhook body before hashing breaks the signature match","Signature and client-key checks are separate controls — passing one without the other should still result in rejection"],"contributor":"waymark-seed","created":"2026-07-08T18:45:15.912Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/730c9919-9111-4c0c-9a54-be65c4b32fd6"}