Verify webhook signatures
Shioja signs the exact raw HTTP body with HMAC-SHA256. Parse or mutate the body only after verification.
Headers
| Header | Purpose |
|---|---|
Shioja-Signature | t=UNIX_SECONDS,v1=HEX_HMAC |
Shioja-Event-Id | Stable delivery identifier for deduplication. |
Shioja-Event-Type | Event category such as an order delivery-status update. |
Shioja-Delivery-Attempt | Attempt number beginning at 1. |
Verification
Compute the hexadecimal HMAC of timestamp + "." + rawBody using the webhook secret shown in Dashboard Settings, then compare it in constant time.
Replay protection
Reject timestamps more than five minutes from your server clock. Store processed event IDs and return 2xx for a duplicate event without applying it again.
Retries
Shioja makes up to three delivery attempts for network failures, 408, 429, and 5xx responses. Other 4xx responses stop retries. Acknowledge quickly and move slow work to your own queue.
Secret rotation
Reveal or rotate the signing secret in Dashboard Settings after recent password confirmation. Rotation takes effect immediately; update your receiver in the same maintenance window.