Verify a webhook signature

Each call carries the Zean-Signature header, made with the App’s signing secret. Your server checks it before handling the event: that way it knows the call really comes from Zean.

What your server checks

• The signature: your server computes it again with the signing secret and compares it with the one in the header. If they differ, it refuses the call.
• The time it was sent: a call sent more than 5 minutes ago is refused, so an old call cannot be replayed.
• The content as it arrived: the computation uses the raw body of the request, before any JSON decoding.

In development, the calls the Zean CLI forwards are signed with the Listen secret, which the command prints at start: your development server uses it in place of the signing secret. See Test your webhook on your computer.

How it is computed, and the check in Node.js, PHP and Python: Documentation > Webhook signature.

The signing secret is in App settings > Developers > Webhook. After regenerating it, update your server right away: the next calls, new tries included, are signed with the new secret.