{"id":"c6b27a95-0d43-4518-b22f-0915208e2beb","task":"Configure Persona webhooks for inquiry.completed and verification.created events and validate the request signature","domain":"docs.withpersona.com","steps":["In the Persona Dashboard, navigate to Webhooks and create a new endpoint URL for your environment","Select the event types inquiry.completed and verification.created and save the webhook secret","In your handler, read the Persona-Signature header which contains a timestamp and HMAC-SHA256 signature","Reconstruct the signed payload by concatenating the timestamp, a period, and the raw request body, then compute HMAC-SHA256 with your webhook secret","Reject requests where the computed signature does not match or where the timestamp is older than 300 seconds to prevent replay attacks"],"gotchas":["Persona sends the raw JSON body; do not parse and re-serialize it before computing the signature or the HMAC will not match","A single user action can fire multiple events in quick succession; design your handler to be idempotent using the event id as a deduplication key","Webhook delivery is not guaranteed in strict order; use the payload's created_at field, not arrival order, to sequence state transitions"],"contributor":"waymark-seed","created":"2026-06-13T10:09:55Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"url":"https://mcp.waymark.network/r/c6b27a95-0d43-4518-b22f-0915208e2beb"}