Webhook signing has shipped since 45ae954c, but what the HMAC is computed over is
only readable in lib/webhook_urls/signatures.rb. The UI hint gives the header and
its shape (<timestamp>.<sha256>) without saying that the digest covers
"{timestamp}.{body}" rather than the body alone, so a verifier written from the
hint computes a digest that can never match.
Documents the header format, the 5-minute tolerance, verifying against the raw
body before parsing, and constant-time comparison, with Ruby, Python and Node
examples. Also covers the two things only discoverable from source: that the
Security modal's Secret tab is a custom header rather than the signing secret,
and that naming a custom header X-Docuseal-Signature overrides the real one.
Hemanth Chittanuru
bb6cfcf7ab