How signature verification works
zaSend signs the exact request body with HMAC-SHA256 and sends the digest in X-zaSend-Signature with a sha256= prefix.
Verify the raw bytes
Whitespace and JSON formatting change the digest. Verify the unmodified request body before parsing JSON, and compare signatures in constant time.
Common questions
Are webhook secrets stored?
No. The secret and payload are used only to calculate this result and are not written to the zaSend database.
Why does a correct-looking payload fail?
The sender may have signed different bytes. Even one added space or newline produces a different HMAC digest.