Verifying Webhook Authenticity

Webhook requests sent from Lendflow include HTTP headers that can be used to verify the request actually came from Lendflow and that the request body was not modified while in transit.

Lendflow-Verification-Signature — the signature to validate against
Lendflow-Verification-Timestamp — a timestamp value

Webhook verification is optional, but recommended.

Verifying a Signature

Signature verification is done within your application’s code by attempting to recreate and match the signature sent in the Lendflow-Verification-Signature header. The process in pseudocode is as follows:

Bash

base64encode(hmac('sha256', timestamp + body, webhook_secret))

If signature verification fails, the webhook request should be rejected.

The Webhook SecretVerification signatures are signed by your organization’s webhook secret; a token that should be viewed and treated like a password. Your organization’s webhook secret must be requested from Lendflow’s customer success team.

Code Examples

PHP

webhook.php

<?php

$signature = $_SERVER['HTTP_Lendflow_Verification_Signature'];
$timestamp = $_SERVER['HTTP_Lendflow_Verification_Timestamp'];
$body = file_get_contents('php://input');
$secret = 'your-webhook-secret-here';

$verification = base64_encode(
    hash_hmac('sha256', $timestamp . $body, $secret, binary: true),
);
    
    
if ($signature !== $verification) {
    http_response_code(400);
    echo "Invalid Webhook";
    exit;
}

echo "Valid Webhook";

Javascript

const express = require('express');
const crypto = require('crypto');
const app = express();

const PORT = 3000;

let body = '';

app.use((req, res, next) => {
  req.setEncoding('utf8');
  req.on('data', (chunk) => body += chunk);
  req.on('end', () => next());
});

app.post('/webhook', (req, res) => {
  const signature = req.headers['lendflow-verification-signature'];
  const timestamp = req.headers['lendflow-verification-timestamp'];
  const secret = 'your-webhook-secret-here';

  const verification = crypto
    .createHmac('sha256', secret)
    .update(timestamp + body)
    .digest('base64');

  console.log('signature:', signature);
  console.log('timestamp:', timestamp);
  console.log('body:', body);

  if (signature !== verification) {
    return res.status(400).send('Invalid Webhook');
  }

  return res.status(200).send('Valid Webhook');
});

app.listen(PORT, () => {
  console.log(`Server is running on port ${PORT}`);
});

Request bodies. If even a single character in the request body changes between departure from Lendflow and receipt on your end, the verification will fail. This notably includes how escape characters are handled by your server. The above examples work without needing to adjust the request bodies, but we’ve seen integrations which require escape characters to be re-escaped. In Javascript this means working with this adjusted variable:

const properlyEscapedBody = body.replace(/\//g, '\\/')

FAQ

Is webhook verification required?

No. Webhook verification is optional, but recommended. It confirms the request came from Lendflow and that the body was not modified in transit.

Where do I get the webhook secret?

Verification signatures are signed by your organization’s webhook secret. Treat that token like a password. Request it from Lendflow’s customer success team.

Why does signature verification fail?

Recreate the signature as base64encode(hmac('sha256', timestamp + body, webhook_secret)) and match it to Lendflow-Verification-Signature. If even a single character in the body changes before you hash it, including how escape characters are handled, verification fails. Reject the request when the signatures do not match.

Verifying Webhook Authenticity