> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getnexor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verifying Signatures

Every webhook delivery is signed with your webhook's **signing secret** using HMAC-SHA256. You should verify the signature to ensure the request is genuinely from Nexor and hasn't been tampered with.

## How it works

1. Nexor computes `HMAC-SHA256(raw_body, signing_secret)` and sends it in the `X-Nexor-Signature` header with a `sha256=` prefix.
2. Your server computes the same HMAC on the raw request body and compares.

## Finding your signing secret

Your signing secret is generated automatically when you create a webhook. You can find it in the [webhook settings](https://app.getnexor.ai/organization/webhooks) page in the Nexor dashboard.

**Caution:** Never expose your signing secret in client-side code or public repositories.