We are trying to verify the HMAC-SHA256 signature for our webhook requests but consistently generate a different signature than the one sent in the typeform-signature header. We have ensured the following:
- The raw request body is identical to what Typeform sends.
- The secret key matches the one set in the webhook settings.
- UTF-8 encoding is correctly applied.
- We’ve tested multiple HMAC implementations (
crypto,crypto-js, OpenSSL), all producing the same but incorrect signature.
Could you clarify if Typeform applies any transformations (e.g., JSON minification, normalisation) before signing the payload? We would greatly appreciate any insights on how we can match the expected signature.
Thanks,
