Signature on Workflow Webhooks

Developer Support APIs & Integrations
, ,
1

Hy, I am having problem to generate the signature

I can not generate the same Signature as HubSpot. I am using Workflow webhooks and I made an example to show you my problem.
You could see the request made by HubSpot in some WorkFlow here https://hookbin.com/yDLPm6nOL6TeWb73yOkd
You could see that the sent signature generated by HubSpot is 51f529658a1fb7bb9634967f2303ef941167a088749c229158a84463a471100e
When I try to generate my own signature (with both versions V1 and V2), I obtain the following (pseudocode with nodeJS).

API_ID = myAppId
METHOD = 'POST'
URI = 'https://hookb.in/yDLPm6nOL6TeWb73yOkd'
BODY_REQUEST = JSON.stringify(req.body) // Body in the examplee https://hookbin.com/yDLPm6nOL6TeWb73yOkd

SignatureV1 = APP_ID + BODY_REQUEST
HashV1 = crypto.createHash('sha256').update(SignatureV1).digest('hex') = '5cfc40dde1840408036842affa8e28bc0a5c80c2dde6fc020fe89a54f693ca26'

SignatureV2 = APP_ID + METHOD + URI + BODY_REQUEST
HashV2 = crypto.createHash('sha256').update(SignatureV2).digest('hex') = '381ed59135449e885d1d94641a6c00a89fe230e06b1e0621b011bd0c98b821de'

I was reading the Blogs and also some of your code in GitHub and some people say that the problem could be the way the body is parsed.
- Here how your NodeJS API calculate the signature
https://github.com/HubSpot/hubspot-api-nodejs/blob/master/sample-apps/webhooks-app/src/js/webhooks-controller.js#L30
- HubSpot Community
https://community.hubspot.com/t5/APIs-Integrations/HubSpot-Signature-with-NET-C/td-p/249446
So, I have changed my code to obtain the body in that way and I still can not obtain the same signature.
If I obtain the ‘rawBody’ in the following way (for nodeJS)

app.use(bodyParser.json({
 verify: (req, res, buf, encoding) => {
 req.rawBody = buf.toString(encoding);
 }
 }))BODY_REQUEST = req.rawBody;

My signatures are still no right

SignatureV1Raw = 220da9f0b6b7c5ff47d2e5fd739e64663c9ec138bfd26712cc9e63afa6f52da4 SignatureV2Raw = 0903e41e1e56d89610cc6439168b8f11c6e83539859b7b4b3a27c510f028954e

If I probe my code with the examples for both signatures, that goes ok
- Accounts Dashboard | HubSpot
- Accounts Dashboard | HubSpot
What am I doing wrong?
Thank you

2

Hey @mgbarnech,

Sincere apologize for the delayed in response.

When looking to verify the Webhook workflow signature, you would need to concatenate the following:

App secret + http method + URI + request body (if present)

Referencing this documentation - Use webhooks with HubSpot workflows

Looking at the code you shared, it looks to me that you’re concatenating the api_id which I assume refer to either the app client id? or App id? As such, could you try changing that to use your client secret (this can be found under your app `Auth` settings).

Let me know how it goes!

3

Hy Wendy
That was exactly my problem. I was using the APP_ID and not the CLIENT_SECRET
Thank you very much!

4

Hey @mgbarnech,

Awesome! Thanks for updating and I’m glad to know that was it!

5

For using Webhook within Workflow , do I have to create a new APP in order sign the request ? If not, what APP ID and CLIENT SECRET needs to be used ?

6

Hey @devtpi,

If you’d like to authenticate any requests to your wehook, you would need to have a app ID.

Otherwise, it is not mandatory to include the App ID.