# Can't Validate Webhooks POST Request

**URL:** <https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656>\
**Category:** APIs & Integrations\
**Tags:** webhooks\
**Created:** [June 5, 2019, 1:04am UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656 "2019-06-05T01:04:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![griffinskudder](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/griffinskudder/32/98942_2.png) [@griffinskudder](https://community.hubspot.com/u/griffinskudder)\
**Post date:** [June 5, 2019, 1:04am UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/1 "2019-06-05T01:04:22Z")

</div>

Hi all,

I’m having an issue trying to validate a webhooks request to my application. I’m following the instructions here: [Accounts Dashboard | HubSpot](https://developers.hubspot.com/docs/methods/webhooks/webhooks-overview#security) but I can’t seem to generate a matching hash.

My code to validate the signature is as follows:

```auto
expected_signature = request.META.get('HTTP_X_HUBSPOT_SIGNATURE')
 raw_data = request.body
 sha256 = hashlib.sha256
 source_bytes = HUBSPOT_CLIENT_SECRET.encode("UTF-8") + raw_data
 local_signature = sha256(source_bytes).hexdigest()
 if expected_signature != local_signature:
 return HttpResponseForbidden()

```

This is written in Python using Django.

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [June 5, 2019, 6:33pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/2 "2019-06-05T18:33:04Z")

</div>

Hey @griffinskudder ,

I’m seeing some strange behavior here as well. I’ll touch base with my team and update this thread when I have more information.

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [June 5, 2019, 7:07pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/3 "2019-06-05T19:07:06Z")

</div>

Hey @griffinskudder ,

Quick update/request: Can you try casting the request body as a string?

---

<div class="post-metadata">

**Author:** ![griffinskudder](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/griffinskudder/32/98942_2.png) [@griffinskudder](https://community.hubspot.com/u/griffinskudder)\
**Post date:** [June 5, 2019, 10:48pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/4 "2019-06-05T22:48:10Z")

</div>

Hi Derek,

No luck there. The request body is already in the format needed for the sha256 hashing algorithm to run on it, so trying to cast it to a string just causes that to fail.

Casting it to a string and then encoding it back into ASCII gives the same result as just leaving it as is.

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [June 6, 2019, 8:02pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/5 "2019-06-06T20:02:46Z")

</div>

Hey @griffinskudder ,

So the odd thing is that I’m having trouble validating the signature for test webhook notificaitons, but I’m succeeding for live webhook notifications by copy/pasting my client secret & request body using the following code:

```auto
import hashlib

client_secret = # Client secret here, pasted as a string
body = # Request body here, pasted as a string
source_string = client_secret + body
finalHash = hashlib.sha256(source_string).hexdigest()
print(finalHash)

```

Are the issues you’re seeing with live webhook notifications? The reason I’m thinking that it may be an encoding/stringification issue of some kind is because I haven’t been able to reproduce the issues myself.

I’m not particularly familiar with Django; is it possible that request.body isn’t encoded correctly? The following stackoverflow article seems to imply it’s a byte string:

> <https://stackoverflow.com/questions/29514077/get-request-body-as-string-in-django>

---

<div class="post-metadata">

**Author:** ![griffinskudder](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/griffinskudder/32/98942_2.png) [@griffinskudder](https://community.hubspot.com/u/griffinskudder)\
**Post date:** [June 6, 2019, 10:46pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/6 "2019-06-06T22:46:24Z")

</div>

Hi Derek,

Thanks very much for your help. It turned out to be the test webhook notifications.

I’ve just tested a live notification and all appears to be working.

---

<div class="post-metadata">

**Author:** ![Derek\_Gervais](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/derek_gervais/32/17429_2.png) [@Derek\_Gervais](https://community.hubspot.com/u/Derek_Gervais)\
**Post date:** [June 7, 2019, 1:24pm UTC](https://community.hubspot.com/t/cant-validate-webhooks-post-request/14656/7 "2019-06-07T13:24:11Z")

</div>

Hey @griffinskudder ,

Makes sense, thanks for sharing! As an update, I just heard from the team this morning that the issue with test webhooks has been resolved, so going forward all webhook-related signatures should function correctly.