> For the complete documentation index, see [llms.txt](https://docs.smartfastpay.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.smartfastpay.com/v1/reference/webhooks/signature.md).

# Webhooks (Signature)

Every notification we send to your endpoint is signed. We do this by including a header named <mark style="color:red;">`"SmartFastPay-Signature"`</mark> in every event we send. This allows you to verify and ensure that the event was sent by SmartFastPay and not a third party.

The <mark style="color:red;">`"SmartFastPay-Signature"`</mark> header contains a <mark style="color:red;">`timestamp`</mark> and one or more signatures. The <mark style="color:red;">`timestamp`</mark> is prefixed by <mark style="color:red;">`t=`</mark> and each signature is prefixed by a schema. Schemas start with <mark style="color:red;">`v`</mark> followed by an <mark style="color:red;">`integer`</mark>. Currently there is only one signature schema which is <mark style="color:red;">`v1`</mark>.

Exemplo do Header SmartFastPay-Signature:

```json
SmartFastPay-Signature: t=1681235417000,v1=b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8
```

Signatures are generated using a hashed message based authentication code <mark style="color:red;">`(HMAC)`</mark> with <mark style="color:red;">`SHA-256`</mark>. To prevent downgrade attacks, you must ignore all non-v1 schemas.

***

### How to validate the signature

#### Step 1: Extract the Timestamp and Signature from the Header

Split the header using the character as a separator to get the list of elements. Once that's done, do another split using the <mark style="color:red;">`=`</mark> character as a separator, to get the prefix and the value.

The value obtained from the <mark style="color:red;">`t`</mark> prefix corresponds to the timestamp and the <mark style="color:red;">`v1`</mark> corresponds to the signature. You can discard other values.<br>

#### Step 2: Prepare the string to compare signatures

You must concatenate this information:

* The timestamp (as <mark style="color:red;">`string`</mark>)
* The character <mark style="color:red;">`.`</mark>
* The JSON payload (request body, in <mark style="color:red;">`string`</mark> format)

Compute the <mark style="color:red;">`HMAC`</mark> with the <mark style="color:red;">`SHA256`</mark> hash function. Use the **secret (see what your secret is by** [**clicking here**](/v1/reference/webhooks/secret.md) **)**.<br>

Example in PHP:

```php
<?php

// This secret is not the secret of the authentication token, it is the UID
$secret = 'my-secret';

// This is the "t" value received on SmartFastPay-Signature header
$timestamp = 1681235417000;

$requestPayload = [
    'callback' => true,
    'value' => 'value-field'
];

$jsonPayload = json_encode($requestPayload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

$paramsSignature = "{$timestamp}.{$jsonPayload}";

echo hash_hmac('sha256', $paramsSignature, $secret);

// Output: b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8
```

#### Step 3: Compare signatures

Compare the signature sent by SmartFastPay in the Header with the signature you generated in **Step 2**.<br>

Example in PHP:

```php
<?php

// Comparing Signatures
// Example Header of the request sent by SmartFastPay:
$headers = [
    'SmartFastPay-Signature' => 't=1681235417000,v1=b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8'
];

// Extract the value of 't' from Header 'SmartFastPay-Signature'
// '1681235417000'
$timestamp = explode("=", explode(",", $headers['SmartFastPay-Signature'])[0])[1];

// Extract the value of 'v1' from Header 'SmartFastPay-Signature'
// 'b9ffafcd16416bd11e36f877c2d7ccc71633d174f8245abc49fc2aef7e6633c8'
$signature = explode("=", explode(",", $headers['SmartFastPay-Signature'])[1])[1];

// The Signature you generated in Step 2 must be equal to the value of the "$signature" variable.
// Must return 1 (true)
echo ('yourSignature' === $signature);
```