René's URL Explorer Experiment

{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://urlpipe.dev/#organization","name":"URLpipe","url":"https://urlpipe.dev","logo":"https://urlpipe.dev/icon.png","sameAs":["https://github.com/URLpipe"],"founder":{"@type":"Person","name":"Roger Campos","url":"https://rogercampos.com"}},{"@type":"WebSite","@id":"https://urlpipe.dev/#website","url":"https://urlpipe.dev","name":"URLpipe","publisher":{"@id":"https://urlpipe.dev/#organization"}}]}

{"@context":"https://schema.org","@graph":[{"@type":"TechArticle","@id":"https://urlpipe.dev/code/python/verify-webhook#article","headline":"Verify an HMAC webhook signature in Python","description":"Verify HMAC-SHA256 webhook signatures in Python: raw body, v1= list, constant-time compare, 5-minute tolerance. Tested code.","url":"https://urlpipe.dev/code/python/verify-webhook","mainEntityOfPage":"https://urlpipe.dev/code/python/verify-webhook","datePublished":"2026-09-24","dateModified":"2026-09-24","author":{"@type":"Person","name":"Roger Campos","url":"https://rogercampos.com"},"publisher":{"@id":"https://urlpipe.dev/#organization"},"image":"https://urlpipe.dev/og-image.png"},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Why verify against the raw body?","acceptedAnswer":{"@type":"Answer","text":"The signature covers the exact bytes that were sent. Parsing the JSON and serializing it again changes key order and whitespace, and the HMAC with them. In Python: request.get_data() in Flask or request.body in Django."}},{"@type":"Question","name":"Why can the signature header hold more than one value?","acceptedAnswer":{"@type":"Answer","text":"During a secret rotation every delivery is signed with the new and the old secret for 24 hours, so a receiver holding either one keeps verifying. Accept the delivery if any v1= value matches."}},{"@type":"Question","name":"What should a receiver answer when the check fails?","acceptedAnswer":{"@type":"Answer","text":"A 401. The delivery is retried with backoff, up to six attempts, and the result stays available from GET /result/:token for 30 days either way."}},{"@type":"Question","name":"Why a five-minute tolerance?","acceptedAnswer":{"@type":"Answer","text":"The timestamp is signed, so it cannot be changed; rejecting old ones stops a captured delivery being replayed later. Every retry is signed afresh, so genuine retries pass."}}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://urlpipe.dev/"},{"@type":"ListItem","position":2,"name":"Code recipes","item":"https://urlpipe.dev/code"},{"@type":"ListItem","position":3,"name":"Python","item":"https://urlpipe.dev/code/python"},{"@type":"ListItem","position":4,"name":"Verify a webhook signature in Python","item":"https://urlpipe.dev/code/python/verify-webhook"}]},{"@type":"HowTo","name":"Verify a webhook signature in Python","description":"To verify a URLpipe webhook in Python, compute HMAC-SHA256 over the X-URLpipe-Timestamp value, a dot and the raw request body, keyed with your whsec_ secret. Prefix it with v1= and compare it with hmac.compare_digest against each comma-separated value of X-URLpipe-Signature; reject timestamps more than five minutes off.","url":"https://urlpipe.dev/code/python/verify-webhook","tool":[{"@type":"HowToTool","name":"Python 3.9+"}],"step":[{"@type":"HowToStep","name":"Before you start","text":"Nothing to install: the receiver below is standard library only. Turn signing on under Settings → Webhook Signing and copy the secret (it starts with whsec_).","url":"https://urlpipe.dev/code/python/verify-webhook#setup"},{"@type":"HowToStep","name":"A receiver that verifies every delivery","text":"verify() is the part to copy into your app. In Flask pass it request.get_data(), in Django request.body — the raw bytes, never request.json re-serialized. hmac.compare_digest takes the same time whether the first byte or the last one differs, which is what stops a timing attack.","url":"https://urlpipe.dev/code/python/verify-webhook#receiver"}]}]}