HubSpot Support Message: Signature Validation Issue with X-HubSpot-Signature (v1)

Developer Support APIs & Integrations
1

Hello HubSpot Support Team,

We’ve been using a webhook integration that relies on validating the X-HubSpot-Signature header using the v1 signature method. This integration has been stable and working correctly for the past 2+ years. However, as of this month (August 2025), signature validation suddenly started failing, without any code changes on our end.

We had been generating the SHA‑256 using only the client secret which previously matched the value of the X-HubSpot-Signature header.

Questions:

  • Has anything changed recently in how HubSpot generates v1 webhook signatures?
    Specifically: Was there a silent change in the input logic from just secret to secret+messageBody?
  • If so, when was this change made and was there any notice or deprecation warning?
  • Is it now required to always use secret+messageBody to compute the signature for v1 validation?

Below link last updated is on Aug 22 2025. Just wanted to double checked is the last change related to secret+requestBody signature generation?

2

Hey @RKOSURI - thanks for posting in the Community!
I’d like to tag in some experts here to see if they have any insight for us! @sylvain_tirreau, @KenF, and @Teun - any thoughts for @RKOSURI?
Shane, Community Manager

3

Hello,

In my opinion, the verification in v1 has always been to use the “Client secret” + “request body” pair. At least since 2019 (August 7th Roundup: 5 New Updates ) : “v1 - an SHA-256 hash built using the client secret of your app and the request body - Used with webhooks.”