# Webhooks (Signature)

Every notification we send to your endpoint is signed. We do this by including a header named <mark style="color:red;">`"SmartFastPay-Signature"`</mark> in every event we send. This allows you to verify and ensure that the event was sent by SmartFastPay and not a third party.

The <mark style="color:red;">`"SmartFastPay-Signature"`</mark> header contains a <mark style="color:red;">`timestamp`</mark> and one or more signatures. The <mark style="color:red;">`timestamp`</mark> is prefixed by <mark style="color:red;">`t=`</mark> and each signature is prefixed by a schema. Schemas start with <mark style="color:red;">`v`</mark> followed by an <mark style="color:red;">`integer`</mark>. Currently there is only one signature schema which is <mark style="color:red;">`v1`</mark>.

Exemplo do Header SmartFastPay-Signature:

```json
SmartFastPay-Signature: t=1681235417000,v1=b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8
```

Signatures are generated using a hashed message based authentication code <mark style="color:red;">`(HMAC)`</mark> with <mark style="color:red;">`SHA-256`</mark>. To prevent downgrade attacks, you must ignore all non-v1 schemas.

***

### How to validate the signature

#### Step 1: Extract the Timestamp and Signature from the Header

Split the header using the character as a separator to get the list of elements. Once that's done, do another split using the <mark style="color:red;">`=`</mark> character as a separator, to get the prefix and the value.

The value obtained from the <mark style="color:red;">`t`</mark> prefix corresponds to the timestamp and the <mark style="color:red;">`v1`</mark> corresponds to the signature. You can discard other values.<br>

#### Step 2: Prepare the string to compare signatures

You must concatenate this information:

* The timestamp (as <mark style="color:red;">`string`</mark>)
* The character <mark style="color:red;">`.`</mark>
* The JSON payload (request body, in <mark style="color:red;">`string`</mark> format)

Compute the <mark style="color:red;">`HMAC`</mark> with the <mark style="color:red;">`SHA256`</mark> hash function. Use the **secret (see what your secret is by** [**clicking here**](/v1/reference/webhooks/secret.md) **)**.<br>

Example in PHP:

```php
<?php

// This secret is not the secret of the authentication token, it is the UID
$secret = 'my-secret';

// This is the "t" value received on SmartFastPay-Signature header
$timestamp = 1681235417000;

$requestPayload = [
    'callback' => true,
    'value' => 'value-field'
];

$jsonPayload = json_encode($requestPayload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

$paramsSignature = "{$timestamp}.{$jsonPayload}";

echo hash_hmac('sha256', $paramsSignature, $secret);

// Output: b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8
```

#### Step 3: Compare signatures

Compare the signature sent by SmartFastPay in the Header with the signature you generated in **Step 2**.<br>

Example in PHP:

```php
<?php

// Comparing Signatures
// Example Header of the request sent by SmartFastPay:
$headers = [
    'SmartFastPay-Signature' => 't=1681235417000,v1=b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8'
];

// Extract the value of 't' from Header 'SmartFastPay-Signature'
// '1681235417000'
$timestamp = explode("=", explode(",", $headers['SmartFastPay-Signature'])[0])[1];

// Extract the value of 'v1' from Header 'SmartFastPay-Signature'
// 'b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8'
$signature = explode("=", explode(",", $headers['SmartFastPay-Signature'])[1])[1];

// The Signature you generated in Step 2 must be equal to the value of the "$signature" variable.
// Must return 1 (true)
echo ('yourSignature' === $signature);
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.smartfastpay.com/v1/reference/webhooks/signature.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.