On this page

Example — verify webhook signature

When you set a signing secret, every delivery includes:

X-Webhook-Signature: <your-secret>
X-ScaliQ-Signature: <your-secret>

Prefer X-Webhook-Signature for new integrations; X-ScaliQ-Signature carries the same value and keeps working for existing setups.

The header value is exactly the string you entered in ScaliQ (e.g. password1234). It is not an HMAC of the body.

n8n (Header Auth)

On the Webhook node:

Header	Value
`X-Webhook-Signature`	the same secret you put in `/api-mcp`

Node.js

import crypto from 'crypto';

function verifyScaliqSignature(signatureHeader, secret) {
  const a = Buffer.from(String(signatureHeader || ''));
  const b = Buffer.from(String(secret || ''));
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

Python

import secrets

def verify_scaliq_signature(signature_header: str, secret: str) -> bool:
    return secrets.compare_digest(signature_header or '', secret or '')

If no signing secret was set on the webhook, deliveries are unsigned (no signature headers).