> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.superpath.io/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # How to Secure a Webhook with Signature Authentication # How to Secure a Webhook with Signature Authentication **In this article:** * Overview * How to turn on signature authentication * How the signature works * Things to keep in mind * FAQs * Who can do this ## Overview Signature authentication lets your receiving endpoint verify that a webhook request genuinely came from SuperPath and not from someone impersonating it. When it is turned on, SuperPath signs every delivery and adds a signature to the request header. Your endpoint recomputes the same signature using a shared secret key and only trusts the request if the two match. Signature authentication is optional and is configured per webhook in the **Add Webhook** or **Update Webhook** window under **Settings → Integrations → Manage webhooks**. > **Note:** Webhooks are only available on paid accounts. If your account is on a free plan, the **Manage webhooks** section shows a message that webhooks are only available for paid accounts, with a link to your **Billing settings** to upgrade. ## How to turn on signature authentication 1. Go to **Settings → Integrations** and scroll to the **Manage webhooks** section. 2. Click **Add webhook** to create a new webhook, or click the pencil (edit) icon on an existing webhook to open it. 3. In the modal, turn on the **Webhook signature auth** toggle. 4. A **Secret key** appears, with a copy button and a refresh button next to it. Click copy to copy the secret to your clipboard. 5. Configure the copied secret on your receiving endpoint so it can verify incoming requests. 6. Finish filling in the webhook (endpoint URL, description, subscribed events) and click **Add** (or **Update**) to save. The secret key is saved together with the webhook. ![](https://storage.googleapis.com/superpath-help-centre/how-to-secure-a-webhook-with-signature-authentication/01-signature-toggle-secret_b6250d86.png) > **Tip:** The secret key is generated in your browser the moment you turn the toggle on, and clicking the refresh button generates a brand new one. It is only saved to the webhook when you click **Add** or **Update**. ## How the signature works When signature authentication is on, SuperPath adds a **`SuperPath-Signature`** header to every request it sends to your endpoint. The header has the form `,` — a Unix timestamp and a signature, separated by a comma. The signature is an HMAC-SHA256 hash of the timestamp, computed using your secret key. To verify a request on your endpoint: split the `SuperPath-Signature` header on the comma to get the timestamp and the received signature, recompute the HMAC-SHA256 of the timestamp using the same secret key, and compare it with the received signature. If they match, the request came from a sender that knows your secret key. The timestamp can also be used to reject requests that are too old and guard against replay attacks. For verification code examples and the full details, see the developer guide [Webhook Signature Authentication](https://help.superpath.io/en/article/webhook-signature-authentication-1toumv3/). ## Things to keep in mind * The secret key is generated in your browser and is only saved when you click **Add** or **Update** — if you close the modal without saving, the key is not stored. * Clicking the refresh button regenerates the secret key. If you save a regenerated key, you must also update it on your receiving endpoint, otherwise signature verification will fail and deliveries will be rejected. * Turning the toggle off removes the secret key from the webhook, so requests will no longer be signed. * Signature authentication only helps if your endpoint actually verifies the signature — SuperPath signs the request, but your endpoint is responsible for checking it. ## FAQs **What header does SuperPath add?** A `SuperPath-Signature` header in the form `,`, where the HMAC is an HMAC-SHA256 of the timestamp signed with your secret key. **Where do I get the secret key?** It appears in the Add/Update Webhook window as soon as you turn on the **Webhook signature auth** toggle. Use the copy button to copy it, then store it securely on your endpoint. **What if I regenerate the secret key?** Clicking refresh creates a new key. Once you save the webhook, the old key stops working, so update the new key on your endpoint at the same time to avoid failed verifications. **How do I verify the signature in my code?** Recompute the HMAC-SHA256 of the timestamp with your secret key and compare it to the signature in the header. See [Webhook Signature Authentication](https://help.superpath.io/en/article/webhook-signature-authentication-1toumv3/) for worked examples. ## Who can do this Only **Owners** and **Admins** can add or edit webhooks and their signature settings. **Managers**, **Content Managers**, **People Managers**, **Instructors**, **Employees** and **Restricted** users cannot — the webhooks feature lives under Settings, which is available to Owners and Admins only.