PRACTICAL FIELD GUIDE
Verify webhook signatures using the raw body
A webhook signature authenticates the exact request bytes used by the sender. Parsing JSON and serializing it again can change those bytes and produce a mismatch.
MCPBackend editorial team · · Examples are illustrative
Put it into practice
- Capture the unmodified request body before a JSON parser consumes it.
- Compute the documented HMAC with the correct webhook signing secret.
- Compare safely and reject invalid signatures before trusting event data.
What this looks like
ILLUSTRATIVE EXAMPLE
A receiver reformats JSON whitespace before verification. The event contents look identical, but the calculated signature differs.
A boundary to keep clear
Do not disable verification because parsed fields appear plausible. Reproduce the exact byte input first.
MCPBackend context
MCPBackend webhooks currently make one delivery attempt with a five-second timeout and no retry or ordering guarantee. Treat them as change notifications, not a durable event ledger. For workflows that must complete, use a durable processing system you operate and reconcile its state against the data API.
Take the next step
Inspect the current project contract, try the change with disposable data, and verify the result through the same credentials your app will use. Record the expected response and one denied-access case before release.
Sources and further reading
These references explain the underlying protocols and design principles. For supported MCPBackend operations and exact request shapes, inspect your project’s generated API contract.