Webhooks

Webhook Security

All webhook payloads are signed with HMAC-SHA256. Verify the X-PlotSpark-Signature header to ensure events are from PlotSparkOS.

// Verify webhook signature (Node.js)
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return signature === `v1=${expected}`;
}