Skip to main content

Setting Up HMAC for Secure Webhooks

Introduction​

One of the challenges in the restaurant technology space is securely and efficiently integrating with various services. Just as OAuth 2.0 provides a secure way for third-party data access, HMAC Webhook Secrets are vital for ensuring the authenticity and integrity of webhook notifications. Implementing HMAC Webhook Secrets is especially essential for POS and DSP applications in the restaurant industry, where timely and secure data exchange is crucial.

When integrating with Stream as a POS or DSP, it is imperative to provide a seamless and secure experience for all stakeholders involved. The implementation of HMAC Webhook Secrets ensures that webhook notifications are only processed if they are verified to be legitimate and unchanged during transmission.

How HMAC Works​

HMAC (Hash-based Message Authentication Code) is a popular method for securing webhook notifications. It involves using a secret key to sign the webhook message and verify its authenticity and integrity. The steps are:

  1. The webhook provider signs the webhook message using the secret key and a hashing algorithm (typically HMAC-SHA256), encodes the resulting signature, and includes it in the webhook request as a header.
  2. The webhook listener receives the request, signs the webhook message using the same secret key, and compares the signature with the one sent in the request header. If the signatures match, the request is considered legitimat

Setting Up HMAC Webhook Secrets​

Obtain Secret Key​

During the initial setup and throughout your partner integration, you will be furnished with a Secret Key. These are essential for validating the signatures of incoming webhook notifications. You can access and refresh these credentials through the Partner Portal.

Secure Webhook Requests​

  1. Hash the payload using the provided secret key (Example Code below)
  2. Provide the signature within the header 'Stream-Webhook-Signature'

Example Code​

const { createHmac } = require("crypto");
const hmacSecret = process.env.WEBHOOK_SECRET;

generateHmacWebhookSignature = (body: string) => {
  const hmac = createHmac("sha256", hmacSecret);
  hmac.update(body);
  return hmac.digest("hex");
};

Conclusion​

Implementing HMAC Webhook Secrets into your product involves setting up secret keys, signing and verifying webhook notifications, and handling webhook data securely. Similar to how OAuth 2.0 is essential for secure third-party data access, HMAC is crucial for verifying the authenticity and integrity of webhook notifications. By carefully considering security aspects and following best practices, you can ensure a streamlined and secure experience for your stakeholders.

If you have any questions or would like to discuss your implementation, please reach out to us at partners@streamorders.com. We appreciate your interest in building high quality solutions for your customers.