Verify Signature

Why Verify Signatures?

Anyone can send a POST request to your webhook URL. Without signature verification, an attacker could send fake payment.success events to your endpoint — causing you to fulfill orders that were never actually paid. CWMPay signs every webhook request using HMAC-SHA256. Always verify this signature before processing.

How It Works

CWMPay generates a signature by running HMAC-SHA256 on the request payload using your Webhook Secret
The signature is sent in the X-CWMPay-Signature header
Your server generates the same signature using the same secret
If both signatures match — the request is genuine

Signature = HMAC-SHA256(webhookSecret, JSON.stringify(payload))
Header = "sha256=" + signature

Getting Your Webhook Secret

Login to app.cwmpay.in
Go to Webhooks section
Set your webhook URL and save
Your Webhook Secret will be displayed once — copy and store it safely

Your webhook secret is shown only once when you first set your webhook URL. Store it in an environment variable immediately. If lost, you’ll need to reset your webhook URL to get a new secret.

Verification Examples

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Express.js usage
app.post('/webhook', express.json(), (req, res) => {
  const signature = req.headers['x-cwmpay-signature'];
  const secret = process.env.CWMPAY_WEBHOOK_SECRET;

  if (!verifyWebhookSignature(req.body, signature, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Safe to process
  const { event, data } = req.body;

  if (event === 'payment.success') {
    // Fulfill order
    console.log('Payment confirmed:', data.orderId);
  }

  res.status(200).json({ received: true });
});

import hmac
import hashlib
import json

def verify_webhook_signature(payload, signature, secret):
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        json.dumps(payload, separators=(',', ':')).encode(),
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(signature, expected)

# Flask usage
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-CWMPay-Signature')
    secret = os.environ.get('CWMPAY_WEBHOOK_SECRET')
    payload = request.get_json()
    
    if not verify_webhook_signature(payload, signature, secret):
        return jsonify({'error': 'Invalid signature'}), 401
    
    if payload['event'] == 'payment.success':
        print('Payment confirmed:', payload['data']['orderId'])
    
    return jsonify({'received': True}), 200

<?php
function verifyWebhookSignature($payload, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac(
        'sha256',
        json_encode($payload),
        $secret
    );
    
    return hash_equals($signature, $expected);
}

$payload = json_decode(file_get_contents('php://input'), true);
$signature = $_SERVER['HTTP_X_CWMPAY_SIGNATURE'];
$secret = getenv('CWMPAY_WEBHOOK_SECRET');

if (!verifyWebhookSignature($payload, $signature, $secret)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

if ($payload['event'] === 'payment.success') {
    // Fulfill order
    error_log('Payment confirmed: ' . $payload['data']['orderId']);
}

http_response_code(200);
echo json_encode(['received' => true]);

Important Notes

Use timing-safe comparison

Always use crypto.timingSafeEqual() (Node.js) or hmac.compare_digest() (Python) instead of === for signature comparison. Regular string comparison is vulnerable to timing attacks.

Use raw body for verification

Verify the signature against the raw JSON string — not a parsed and re-serialized object. JSON key ordering may differ and cause signature mismatch.

    // WRONG — re-serialized object may differ
    JSON.stringify(JSON.parse(rawBody))

    // CORRECT — use raw body directly
    rawBody.toString()

Store secret in environment variables

    # .env
    CWMPAY_WEBHOOK_SECRET=your_webhook_secret_here

Never hardcode the secret in your source code.

Next Steps

Webhooks Overview

Learn about webhook events and payload

Error Reference

View all error codes

Get Started

INR Payments

Webhooks

Help

Verify Signature

Why Verify Signatures?

How It Works

Getting Your Webhook Secret

Verification Examples

Important Notes

Next Steps

Webhooks Overview

Error Reference

​Why Verify Signatures?

​How It Works

​Getting Your Webhook Secret

​Verification Examples

​Important Notes

​Next Steps

Webhooks Overview

Error Reference

Why Verify Signatures?

How It Works

Getting Your Webhook Secret

Verification Examples

Important Notes

Next Steps