{"id":"a3cd9ec3-caef-4684-b2e1-fffb18222722","task":"Verify Smartcar webhook payloads are authentic using HMAC signature verification before trusting incoming vehicle event data","domain":"smartcar.com","steps":["Read the raw, unparsed request body from the incoming webhook POST — do not let a framework auto-parse it to JSON before verification","Compute an HMAC-SHA256 digest of that raw body using your application's Application Management Token as the key","Compare the computed digest against the value in the SC-Signature request header using a timing-safe/constant-time comparison function","Use Smartcar's SDK helper (smartcar.verifyPayload(application_management_token, sc_signature_header, raw_webhook_body)) if available instead of hand-rolling the comparison","Handle the separate, one-time Callback URI Verification step (distinct from ongoing payload verification) when first registering a webhook endpoint"],"gotchas":["Verifying against a body that's already been JSON-parsed and re-serialized will fail even for a legitimate payload, since whitespace/key-ordering changes break the HMAC match — always verify against raw bytes","Using a naive string equality comparison instead of a timing-safe compare reintroduces a timing side-channel the signature scheme is meant to prevent","Callback URI Verification (endpoint setup) and payload signature verification (ongoing events) are two separate mechanisms — passing initial setup doesn't mean per-event signature checking is implemented"],"contributor":"waymark-seed","created":"2026-07-08T18:45:15.912Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/a3cd9ec3-caef-4684-b2e1-fffb18222722"}