How to Secure a Webhook with Signature Authentication

In this article:

• Overview
• How to turn on signature authentication
• How the signature works
• Things to keep in mind
• FAQs
• Who can do this

Overview

Signature authentication lets your receiving endpoint verify that a webhook request genuinely came from SuperPath and not from someone impersonating it. When it is turned on, SuperPath signs every delivery and adds a signature to the request header. Your endpoint recomputes the same signature using a shared secret key and only trusts the request if the two match.

Signature authentication is optional and is configured per webhook in the Add Webhook or Update Webhook window under Settings → Integrations → Manage webhooks.

Note: Webhooks are only available on paid accounts. If your account is on a free plan, the Manage webhooks section shows a message that webhooks are only available for paid accounts, with a link to your Billing settings to upgrade.

How to turn on signature authentication

1. Go to Settings → Integrations and scroll to the Manage webhooks section.
2. Click Add webhook to create a new webhook, or click the pencil (edit) icon on an existing webhook to open it.
3. In the modal, turn on the Webhook signature auth toggle.
4. A Secret key appears, with a copy button and a refresh button next to it. Click copy to copy the secret to your clipboard.
5. Configure the copied secret on your receiving endpoint so it can verify incoming requests.
6. Finish filling in the webhook (endpoint URL, description, subscribed events) and click Add (or Update) to save. The secret key is saved together with the webhook.

Tip: The secret key is generated in your browser the moment you turn the toggle on, and clicking the refresh button generates a brand new one. It is only saved to the webhook when you click Add or Update.

How the signature works

When signature authentication is on, SuperPath adds a SuperPath-Signature header to every request it sends to your endpoint. The header has the form <timestamp>,<hmac> — a Unix timestamp and a signature, separated by a comma. The signature is an HMAC-SHA256 hash of the timestamp, computed using your secret key.

To verify a request on your endpoint: split the SuperPath-Signature header on the comma to get the timestamp and the received signature, recompute the HMAC-SHA256 of the timestamp using the same secret key, and compare it with the received signature. If they match, the request came from a sender that knows your secret key. The timestamp can also be used to reject requests that are too old and guard against replay attacks.

For verification code examples and the full details, see the developer guide Webhook Signature Authentication.

Things to keep in mind

• The secret key is generated in your browser and is only saved when you click Add or Update — if you close the modal without saving, the key is not stored.
• Clicking the refresh button regenerates the secret key. If you save a regenerated key, you must also update it on your receiving endpoint, otherwise signature verification will fail and deliveries will be rejected.
• Turning the toggle off removes the secret key from the webhook, so requests will no longer be signed.
• Signature authentication only helps if your endpoint actually verifies the signature — SuperPath signs the request, but your endpoint is responsible for checking it.

FAQs

What header does SuperPath add?
A SuperPath-Signature header in the form <timestamp>,<hmac>, where the HMAC is an HMAC-SHA256 of the timestamp signed with your secret key.

Where do I get the secret key?
It appears in the Add/Update Webhook window as soon as you turn on the Webhook signature auth toggle. Use the copy button to copy it, then store it securely on your endpoint.

What if I regenerate the secret key?
Clicking refresh creates a new key. Once you save the webhook, the old key stops working, so update the new key on your endpoint at the same time to avoid failed verifications.

How do I verify the signature in my code?
Recompute the HMAC-SHA256 of the timestamp with your secret key and compare it to the signature in the header. See Webhook Signature Authentication for worked examples.

Who can do this

Only Owners and Admins can add or edit webhooks and their signature settings. Managers, Content Managers, People Managers, Instructors, Employees and Restricted users cannot — the webhooks feature lives under Settings, which is available to Owners and Admins only.

Updated on: 19/07/2026