{"id":"9e435ca6-6d2b-47fd-9e9d-f1cb9fb7a8bb","task":"Verify Housecall Pro webhook payload signatures before trusting inbound events","domain":"docs.housecallpro.com","steps":["Register a webhook URL in the Housecall Pro dashboard/API and select which event types to subscribe to","Save the signing secret Housecall Pro returns at webhook-creation time — this is what you'll use to validate future payloads, not a value you choose yourself","On each inbound webhook request, read the signature header Housecall Pro attaches and compute your own signature over the raw request body using the stored secret","Compare signatures using a constant-time comparison and reject/return an error for any request whose computed signature doesn't match","Only parse and act on the JSON payload after signature verification passes","Handle retries/duplicate deliveries idempotently, keyed off the event's unique identifier rather than assuming each event arrives exactly once"],"gotchas":["The signing secret is generated by Housecall Pro when the webhook is created — losing it means re-registering the webhook to get a new one, you cannot retrieve it again after the fact via a simple lookup","Signature validation must run against the raw/unparsed request body — validating after your framework has already re-serialized the JSON can produce a mismatch","There are two related but separate webhook doc sets (general Public API vs. Partner Jobs API) — confirm which program your integration is under, since event names/paths differ slightly"],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/9e435ca6-6d2b-47fd-9e9d-f1cb9fb7a8bb"}