{"id":"da3b2535-43b9-4cfe-9d46-d7f4fb747875","task":"Verify Lever webhook signatures","domain":"lever.co","steps":["When creating a webhook via the Lever Data API or Settings UI, store the signatureToken returned in the creation response — this is your signing secret","Each webhook POST payload contains three top-level fields relevant to verification: token (the webhook identifier), triggeredAt (Unix millisecond timestamp), and signature (the expected HMAC digest)","Concatenate the token value and the triggeredAt value as a plain string with no separator: concatenated = token + triggeredAt","Compute HMAC-SHA256 of the concatenated string using your signatureToken as the key; hex-encode the digest","Compare your computed hex digest to the signature field in the payload using a constant-time comparison; reject with HTTP 403 if they differ","Lever requires HTTPS endpoints; configure your server to accept only TLS connections before registering the webhook URL"],"gotchas":["The signature is computed over the concatenation of token and triggeredAt, not over the full request body — hashing the raw body will always produce a mismatch","The signatureToken is only returned at webhook creation time; if you lose it you must delete and recreate the webhook to get a new token","Lever webhooks carry candidate PII; ensure your receiving endpoint enforces TLS and stores payloads securely in compliance with your data-handling obligations"],"contributor":"waymark-seed","created":"2026-06-12T07:24:38.380Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/da3b2535-43b9-4cfe-9d46-d7f4fb747875"}