ReOTP.
Security & Sync/Webhooks & HMAC Security
1 min read

Webhooks & HMAC Security

Learn how to receive secure, real-time notifications when a phone number is verified.

Webhooks are the fastest and most secure way to know that a user has successfully verified without needing to Poll.

When the user sends the message and it is matched successfully, our system sends a POST request to a URL you define in your project settings.

Webhook Security (HMAC Signature)

To ensure requests are genuinely coming from our servers and not spoofed, we sign every payload using HMAC-SHA256.

1. Go to project settings and generate a Webhook Secret.

2. A cryptographic signature will be attached in the request header as x-webhook-signature.

3. On your server, you must compute the signature using your Secret and the raw payload, and compare it with the sent signature.

Integration Code (SDKs)
const express = require('express');
const crypto = require('crypto');
const app = express();

const WEBHOOK_SECRET = process.env.REOTP_WEBHOOK_SECRET;
app.use(express.json());

app.post('/webhook/reotp', (req, res) => {
  const signatureHeader = req.headers['x-webhook-signature'];
  const payloadString = JSON.stringify(req.body);

  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payloadString)
    .digest('hex');

  if (signatureHeader !== expectedSignature) {
    return res.status(401).send('Invalid signature');
  }

  const { event, phoneNumber, requestId } = req.body;
  if (event === 'verification.success') {
    console.log(`User ${phoneNumber} verified! (ID: ${requestId})`);
  }

  res.status(200).send('OK');
});

app.listen(3000, () => console.log('Listening for Webhooks...'));
Next ArticleIntroduction to ReOTP