Skip to main content
AccessOwl signs every webhook request using RFC 9421 HTTP Message Signatures. The signing scheme used is Ed25519 (asymmetric). Each request includes three headers you can use for verification:
HeaderDescription
Content-DigestSHA-512 hash of the request body, formatted as sha-512=:BASE64:
Signature-InputDescribes which request components were signed, the creation timestamp, and the key ID. Example: sig=("@target-uri" "content-digest" "content-type" "idempotency-key");created=1718884473;keyid="whsec_abc123"
SignatureThe actual signature over the covered components, formatted as sig=:BASE64:
The key ID in Signature-Input matches the whsec_... identifier shown in Settings → Webhooks, where you can also retrieve the public key to verify signatures.
Its advised to verify the signature before processing a webhook payload. Reject any request where verification fails.

​
Constructing the signature base

To verify the signature you must reconstruct the same signature base that AccessOwl signed. The procedure follows RFC 9421 §2.5:
  1. For each component listed in Signature-Input, in order, emit one line formatted as: 
    "<component-name>": <component-value>
  2. Append a final line using the exact string value of the Signature-Input header: 
    "@signature-params": <Signature-Input value>
  3. Join all lines with a single newline character (\n). There is no trailing newline.
AccessOwl always covers four components in this fixed order: @target-uri, content-digest, content-type, idempotency-key. Example signature base: 
"@target-uri": https://your-endpoint.example.com/webhook
"content-digest": sha-512=:WZDPaVn/7XgHaAy8pmojAkGWoRx2UFChF41A2svX+TaPm+AbwAgBWnrIiYllu7BNNyealdVLvRwEmTHWXvJwew==:
"content-type": application/json
"idempotency-key": 018f1e2a-3b4c-7d8e-9f0a-1b2c3d4e5f6a
"@signature-params": ("@target-uri" "content-digest" "content-type" "idempotency-key");created=1718884473;keyid="whsec_abc123"
Take @target-uri from the full request URL (including scheme and path) and content-digest directly from the Content-Digest request header. Once assembled, verify the Signature header value against this base using the Ed25519 public key for your webhook endpoint, which is available in Settings → Webhooks.
We recommend using an HTTP Message Signatures library for your language rather than implementing RFC 9421 verification from scratch.