Skip to main content
Every webhook delivery is signed with your webhook’s signing secret using HMAC-SHA256. You should verify the signature to ensure the request is genuinely from Nexor and hasn’t been tampered with.

​
How it works

  1. Nexor computes HMAC-SHA256(raw_body, signing_secret) and sends it in the X-Nexor-Signature header with a sha256= prefix.
  2. Your server computes the same HMAC on the raw request body and compares.

​
Finding your signing secret

Your signing secret is generated automatically when you create a webhook. You can reveal and copy it from Developers → Webhooks in the Nexor dashboard. Caution: Never expose your signing secret in client-side code or public repositories.
Last modified on September 7, 2026