Verify webhook signatures Zof Documentation

Overview

Verify HMAC-SHA256 signatures on incoming Zof webhook payloads before processing run.completed or remediation events. Prevents forged callbacks from blocking pipelines or creating false Jira tickets.

Prerequisites

Organization API key or authenticated CLI
Staging environment for safe experimentation

Step-by-step procedure

Prepare environment

Store ZOF_API_KEY in CI secrets or local env.

Confirm target project and suite IDs in Console.

Apply pattern

Copy example configuration into your pipeline or service.

Adjust environment names and notification channels.

Validate

Run once manually before enforcing gates.

Capture run ID in runbook for support reference.

Best practices

Use raw request body for HMAC, not re-serialized JSON
Rotate signing secrets via Admin Center without changing endpoint URL
Return 2xx only after idempotent event handling completes

Example implementation

import crypto from 'crypto';
export function verifyZofSignature(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}