Skip to main content
  1. Read the request body as-is (UTF-8 text). Do not modify or re-serialize it.
  2. Get the value of the X-Telehealth-Signature header. The platform sends only the value in lowercase hexadecimal (no prefix like sha256=).
  3. Compute HMAC-SHA256 using the body (UTF-8 bytes) as input and your secret (UTF-8 bytes). Convert the result to lowercase hexadecimal.
  4. Compare that value with the header (use constant-time comparison). If they do not match, do not process the request and respond with 401 Unauthorized.
  5. If they match, you can parse the JSON and process the event according to X-Telehealth-Event or the event field in the body.
Security: Do not trust the payload until you have verified the signature. Skipping this step can allow third parties to send fake events to your URL.
Code examples by language in Signature verification – examples.