Verify webhook signatures

Overview

Verify HMAC-SHA256 signatures on incoming Zof webhook payloads before processing run.completed or remediation events. Prevents forged callbacks from blocking pipelines or creating false Jira tickets.

Who should read this

• QA engineers, SREs, platform teams, and developers operating Zof Console and APIs.

Prerequisites

• Organization API key or authenticated CLI
• Staging environment for safe experimentation

When to use this workflow

• Onboarding new team members to Zof terminology and workflows
• Authoring internal runbooks aligned with Console labels
• Designing CI/CD or webhook integrations against documented behavior

Step-by-step procedure

Key concepts

Organization scope

All Zof Console and API operations are isolated to your authenticated tenant.

Governed execution

Agent output and remediation follow policy packs with human approval when configured.

Best practices

• Use raw request body for HMAC, not re-serialized JSON
• Rotate signing secrets via Admin Center without changing endpoint URL
• Return 2xx only after idempotent event handling completes

Example implementation

import crypto from 'crypto';
export function verifyZofSignature(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

Related documentation