> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

# Webhook signature verification

> Configure webhook signature verification in your Fern-generated SDKs to validate HMAC or asymmetric signatures, protect against replay attacks, and ensure webhook authenticity.

#### Enterprise feature

This feature is available only for the [Enterprise plan](https://buildwithfern.com/pricing). To get started, reach out to [support@buildwithfern.com](mailto:support@buildwithfern.com).

When you define webhooks in your API spec, Fern automatically generates utilities that allow your SDK users to verify webhook signatures and ensure events originate from your API. These helpers are generated for the TypeScript, Python, Java, Go, PHP, Ruby, and C# SDKs.

Fern supports two signature verification methods:

* **Hash-based Message Authentication Code (HMAC)** — Symmetric key verification using shared secrets
* **Asymmetric** — Public key verification using RSA, Elliptic Curve Digital Signature Algorithm (ECDSA), or Ed25519 keys

## Generated SDK behavior

The generated SDK exposes a `WebhooksHelper` class with a static `verifySignature` method that returns whether the request is authentic. It takes the raw request body, the signature header value, the signing key (a shared secret for HMAC, a public key for asymmetric verification), and one parameter per additional payload component. A webhook that overrides the document-level configuration gets its own helper, such as `PlantShippedWebhooksHelper`.

These examples verify an HMAC signature over a timestamp and body:

#### TypeScript

```typescript
import { WebhooksHelper } from "my-api";

const isValid = await WebhooksHelper.verifySignature(
  requestBody,
  signatureHeader,
  process.env.WEBHOOK_SECRET,
  timestampHeader,
);
```

#### Python

```python
from my_api import WebhooksHelper

is_valid = WebhooksHelper.verify_signature(
    request_body=request_body,
    signature_header=signature_header,
    signature_key=os.environ["WEBHOOK_SECRET"],
    timestamp_header=timestamp_header,
)
```

#### Java

```java
import com.example.myapi.WebhooksHelper;

boolean isValid = WebhooksHelper.verifySignature(
    requestBody,
    signatureHeader,
    System.getenv("WEBHOOK_SECRET"),
    timestampHeader);
```

#### Go

```go
import myapi "github.com/example/my-api-go"

isValid, err := myapi.WebhooksHelper{}.VerifySignature(
	requestBody,
	signatureHeader,
	os.Getenv("WEBHOOK_SECRET"),
	timestampHeader,
)
```

#### PHP

```php
use MyApi\WebhooksHelper;

$isValid = WebhooksHelper::verifySignature(
    $requestBody,
    $signatureHeader,
    getenv('WEBHOOK_SECRET'),
    $timestampHeader,
);
```

#### Ruby

```ruby
require "my_api"

is_valid = MyApi::WebhooksHelper.verify_signature(
  request_body: request_body,
  signature_header: signature_header,
  signature_key: ENV["WEBHOOK_SECRET"],
  timestamp_header: timestamp_header
)
```

#### C\#

```csharp
using MyApi;

var isValid = WebhooksHelper.VerifySignature(
    requestBody,
    signatureHeader,
    Environment.GetEnvironmentVariable("WEBHOOK_SECRET"),
    timestampHeader
);
```

## Setting up webhook signature verification

Configure signature verification in your API definition with the [`x-fern-webhook-signature` extension](/learn/api-definitions/openapi/endpoints/webhooks#sdk-signature-verification), at the document level (inherited by all webhooks) or per-webhook.

> Configure webhook signature verification in your Fern-generated SDKs to validate HMAC or asymmetric signatures, protect against replay attacks, and ensure webhook authenticity.