Webhook Secrets

Setting up Webhook Signatures

You create and set the webhook secret. HoneyCoin does not generate a webhook secret for you to copy.

1. Create a strong random secret. For example, you can run openssl rand -hex 32.
2. In the HoneyCoin dashboard, go to Developers > API Keys.
3. Enter your secret in the Webhook Secrets field for the appropriate environment and select Save.
4. Store the same secret securely in your server-side environment or secrets manager.

HoneyCoin stores the secret and sends the same value in the X-Webhook-Signature header of webhook requests. Sandbox and production secrets are configured separately.

Verifying Signatures

When you receive a webhook, you should:

1. Get the signature from the X-Webhook-Signature header.
2. Compare this value with the secret you created and stored.
3. Only process the webhook if the signatures match.

Here's an example of verifying a webhook in Node.js:

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const webhookSecret = process.env.WEBHOOK_SECRET; // Your stored secret
  
  if (signature !== webhookSecret) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook...
});

Security Best Practices

1. Always verify the signature of incoming webhooks
2. Keep your webhook secret secure and never commit it to version control.
3. Rotate your webhook secret periodically.
4. Use HTTPS endpoints for receiving webhooks.
5. Implement timeout handling for webhook processing.