On this page

Example — verify webhook signature

Header: X-ScaliQ-Signature: <your-secret>
ScaliQ sends the signing secret you configured as the header value (plain text, not HMAC).

Node.js

import crypto from 'crypto';

function verifyScaliqSignature(signatureHeader, secret) {
  const a = Buffer.from(String(signatureHeader || ''));
  const b = Buffer.from(String(secret || ''));
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

Python

import secrets

def verify_scaliq_signature(signature_header: str, secret: str) -> bool:
    return secrets.compare_digest(signature_header or '', secret or '')

n8n

Use Header Auth: name X-ScaliQ-Signature, value = the same secret as in ScaliQ.

If no signing secret was set on the webhook, deliveries are unsigned.