Skip to main content

Documentation Index

Fetch the complete documentation index at: https://dev.moonpay.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Checking a Webhook Signature

MoonPay signs the webhook events and requests we send to your endpoints. We do so by including a signature in each event’s Moonpay-Signature-V2 header. This allows you to validate that the events and requests were sent by MoonPay, not by a third party. Before you can verify Moonpay-Signature-V2 signatures for webhook events, you need to retrieve your webhook API key from the Developers page on the MoonPay dashboard. The Moonpay-Signature-V2 header contains a timestamp and one signature. The timestamp is prefixed by t=, and the signature is prefixed by s=. 
t=1492774577,s=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
MoonPay generates signatures using a hash-based message authentication code (HMAC) with SHA-256.
1
Split the header, using the , character as the separator, to get a list of elements. Then split each element, using the = character as the separator, to get a prefix and value pair.The value for the prefix t corresponds to the timestamp, and s corresponds to the signature.
2
You achieve this by concatenating:
  • The timestamp (as a string)
  • The character . and
  • For a POST request, the actual JSON payload (i.e., the request’s body). For a GET request, the search string (e.g., ?externalCustomerId=adbb317d-cde9-4ebb-93a3-1b271812de06).
3
Compute a HMAC with the SHA-256 hash function. Use your account’s webhook API key as the key, and use the signed_payload string as the message in both cases.Compare the signature in the header to the expected signature.