Verify webhook signatures

Shioja signs the exact raw HTTP body with HMAC-SHA256. Parse or mutate the body only after verification.

Headers

HeaderPurpose
Shioja-Signaturet=UNIX_SECONDS,v1=HEX_HMAC
Shioja-Event-IdStable delivery identifier for deduplication.
Shioja-Event-TypeEvent category such as an order delivery-status update.
Shioja-Delivery-AttemptAttempt number beginning at 1.

Verification

Compute the hexadecimal HMAC of timestamp + "." + rawBody using the webhook secret shown in Dashboard Settings, then compare it in constant time.

Replay protection

Reject timestamps more than five minutes from your server clock. Store processed event IDs and return 2xx for a duplicate event without applying it again.

Retries

Shioja makes up to three delivery attempts for network failures, 408, 429, and 5xx responses. Other 4xx responses stop retries. Acknowledge quickly and move slow work to your own queue.

Secret rotation

Reveal or rotate the signing secret in Dashboard Settings after recent password confirmation. Rotation takes effect immediately; update your receiver in the same maintenance window.