Skip to content
Authometry Dashboard

Start

Getting startedApplications

OAuth and OIDC

Authorization Code with PKCERedirect URI matchingToken endpointDevice Authorization

Operate

MCP serverConfiguration as codeAccount provisioningWebhook verificationErrors and traces

Operate

Webhook verification

Verify signed audit-event deliveries and apply side effects exactly once.

Verify before parsing

Read the raw request body. Compute HMAC-SHA-256 over the timestamp, a period, and those exact bytes. Compare the hexadecimal digest with x-authometry-signature in constant time.

Example
signed = x-authometry-timestamp + '.' + rawBody
expected = HMAC_SHA256(webhookSecret, signed)
received = x-authometry-signature.replace('v1=', '')

Reject unsafe deliveries

  • Reject timestamps outside a short tolerance to limit replay.
  • Deduplicate x-authometry-delivery before applying side effects.
  • Return a 2xx only after the event is durably accepted.
  • Rotate by creating a new secret, updating the consumer, then retiring the old subscription.

Delivery behavior

Authometry sends HTTPS POST requests with a ten-second timeout. Failed deliveries use exponential retry delays and retain bounded response details for diagnostics. Destinations resolving to private or reserved addresses are rejected.

On this page

Verify before parsingReject unsafe deliveriesDelivery behavior