Callback Authorization Process
All callbacks, including inbound messages and DLRs, can be validated using the algorithm described below. This provides a secure and standardized method for authenticating webhook requests between systems.
It Prevents
- unauthorized requests
- spoofed callbacks
- malicious payload injections
Overall approach
- Create Header-based auth with following combination
- timestamp validation
- signature verification
- nonce checks
- Each Webhook request will have an HMAC signature created using below
method-- signed_data = request_body + "." + nonce + "." + timestamp
- HMAC signature- Base64( HMAC-SHA256( secret, signed_data ) )
- Following Headers are attached to each callback requests- (Inbound and DLRS ) for validation purpose
| Header Name | value |
|---|---|
| x-sinch-webhook-signature | Base64-encoded HMAC-SHA256 signature |
| x-sinch-webhook-signature-nonce | Unique random string per request-(used to create signed_data as mentioned above) |
| x-sinch-webhook-signature-timestamp | Unix epoch seconds (UTC) |
| x-sinch-webhook-signature-algorithm | The HMAC signature algorithm that was used to compute the signature. For now it's set to HmacSHA256. |
Client's can validate the Inbound/DLR requests by decoding the SHA256 signature using the above methodology and the corresponding secret key.