Native HMAC Signature Verification for Inbound Webhook Trigger
D
Dave D
Please add optional HMAC signature validation directly inside the Inbound Webhook workflow trigger.
The Problem:
Many third-party platforms (payment processors, custom SaaS tools,etc) issue an HMAC key and send a signature header (e.g., X-Signature) to verify payload authenticity. Currently, HighLevel cannot validate header signatures on incoming webhooks. This forces users to route webhooks through middleware (Make, Zapier, or a custom server) just to verify the request before forwarding it to HighLevel.
Proposed Solution:
Add an optional HMAC Verification configuration block inside the Inbound Webhook trigger settings:
Secret Key Field: Input for the shared secret/HMAC key.
Header Name Field: Input to specify the signature header (e.g., X-Signature, X-Hub-Signature-256).
Algorithm Selection: Dropdown to select the hashing algorithm (e.g., SHA-256, SHA-1).
Behavior: Automatically reject or drop incoming requests if the computed signature does not match the header.
Why This Matters:
This would allow users to build secure, direct integrations with external tools without needing expensive third-party middleware or custom code servers.
Log In
S
Sachin Karma - SALES
Hey Dave,
Until HighLevel ships native HMAC validation, I'll build you a secure, direct-integration layer that verifies inbound webhook signatures before anything reaches your workflows—no expensive Make/Zapier middleware needed. You get the exact reject-on-mismatch behavior you described.
Here's the approach:
Set up a lightweight verification endpoint that computes and checks the signature header (X-Signature, X-Hub-Signature-256, etc.)
Support SHA-256/SHA-1 algorithm selection and your shared secret key
Auto-reject or drop payloads that fail verification, forward only valid ones to GHL
Wire verified webhooks straight into your Inbound Webhook trigger
Keep secrets secured and out of logs