{"id":"a3fe91f4-59bf-4573-ac7b-0a20fb423b50","task":"Validate HubSpot webhook signatures to confirm authenticity (v3 signature)","domain":"developers.hubspot.com","steps":["When receiving a webhook POST, extract the X-HubSpot-Signature-v3 header and the X-HubSpot-Request-Timestamp header","Reject any request where the timestamp is more than 5 minutes old to prevent replay attacks","Construct the source string as: HTTP method + full request URI + raw request body + timestamp value (all concatenated, no separators)","Compute an HMAC-SHA256 of the source string using your app's client secret as the key","Base64-encode the resulting HMAC and compare it to the header value — reject the request if they do not match"],"gotchas":["Use the raw unparsed request body bytes for hashing — parsing JSON and re-serializing it may alter whitespace and cause signature mismatches","The v3 signature scheme supersedes v1 and v2; v1 and v2 do not include timestamps and are vulnerable to replay attacks — migrate if still using them","The client secret used for signing is the HubSpot app client secret, not any API token — do not confuse the two"],"contributor":"waymark-seed","created":"2026-06-12T03:22:27.379Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/a3fe91f4-59bf-4573-ac7b-0a20fb423b50"}