# Trouble Validating Workflow Webhook Signature

**URL:** <https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372>\
**Category:** APIs & Integrations\
**Tags:** workflows\
**Created:** [July 18, 2019, 2:47am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372 "2019-07-18T02:47:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MichaelJC91](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/michaeljc91/32/2401_2.png) [@MichaelJC91](https://community.hubspot.com/u/MichaelJC91)\
**Post date:** [July 18, 2019, 2:47am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/1 "2019-07-18T02:47:45Z")

</div>

I’ve created my own API using Node JS to connect various services together and since removing Basic Auth I’m having trouble validating hashes.

Whenever I get the Hubspot hash on the server side it seems to be different every time. Eg when I tested the webhook on [https://webhook.site](https://webhook.site/) with two different requests and got:

```auto
x-hubspot-signature 84bbaa2032d9fba11aad241e14843b4fdc68f853ae8447a6f5114ddf3656b825

x-hubspot-signature 67f176ed749b3a5a2fe3f470246612264575077e5677f76b02c220e784532c66

```

Now my server side code to create the hash is:

```auto
const {SHA256} = require("crypto-js");

const clientSecret = "b17ff856-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
const body = req.body;
const hashString = clientSecret + body;

const signature = SHA256(hashString).toString();

```

`10ceaecfcd9b286874d96bb8b26435f57982d96243197f770956341261990844`

But it’s still not giving me the correct hash.

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![MichaelJC91](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/michaeljc91/32/2401_2.png) [@MichaelJC91](https://community.hubspot.com/u/MichaelJC91)\
**Post date:** [July 18, 2019, 5:27am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/2 "2019-07-18T05:27:45Z")

</div>

Even if I plug in the parameters needed into an online Hash generator, I still get an incorrect match. I’ve been going off this documentation:

> **[Accounts Dashboard | HubSpot](https://app.hubspot.com/myaccounts?next=developerdocs&redirect=%2Ffaq%2Fvalidating-requests-from-hubspot)**

I’ve also tried using different parameters but still no luck.

---

<div class="post-metadata">

**Author:** ![WendyGoh](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/wendygoh/32/42320_2.png) [@WendyGoh](https://community.hubspot.com/u/WendyGoh)\
**Post date:** [July 22, 2019, 7:35am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/3 "2019-07-22T07:35:10Z")

</div>

Hi @MichaelJC91,

I hope all is well with you 🙂

When comparing the X-Hubspot-Signature I retrieved from using the requestinspector generated URL and testing it with a webhook subscription e.g. contact property change first name with the java code you provided, I’m able to see that the signature matches.

Could you try entering a URL to test the subscription in your ‘Webhook subscription details’ \> Grab the X-Hubspot-Signature \> Use the raw sample JSON payload to generate the X-Hubspot-Signature \> Do a comparison and see if it matches?

If it doesn’t, we can pin down the issue to - _client secret mismatch_.

Can you try this out and let me know how it goes?

---

<div class="post-metadata">

**Author:** ![MichaelJC91](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/michaeljc91/32/2401_2.png) [@MichaelJC91](https://community.hubspot.com/u/MichaelJC91)\
**Post date:** [July 22, 2019, 7:48am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/4 "2019-07-22T07:48:17Z")

</div>

Hi @WendyGoh,

Thanks for replying so quickly!

I should clarify something before going forward, I’m using a Webhook that gets triggered via a Workflow. Is what your suggesting going to also work for that?

---

<div class="post-metadata">

**Author:** ![WendyGoh](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/wendygoh/32/42320_2.png) [@WendyGoh](https://community.hubspot.com/u/WendyGoh)\
**Post date:** [July 23, 2019, 2:18am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/5 "2019-07-23T02:18:22Z")

</div>

Hi @MichaelJC91,

Thank you for the clarification.

When verify request signatures in workflow webhooks, the concatention of the X-HubSpot-Signature header is different from the Webhooks API.

As documentated here: [Verify request signatures in workflow webhooks](https://knowledge.hubspot.com/articles/kcs_article/workflows/how-do-i-use-webhooks-with-hubspot-workflows#verify-request-signatures-in-workflow-webhooks)

`HubSpot will populate the webhook with a X-HubSpot-Signature header with a SHA-256 hash of the concatenation of the app-secret for your application, the HTTP method, the URI, and the unparsed body.`

Hope this helps to clarify!

---

<div class="post-metadata">

**Author:** ![MichaelJC91](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/michaeljc91/32/2401_2.png) [@MichaelJC91](https://community.hubspot.com/u/MichaelJC91)\
**Post date:** [July 23, 2019, 2:19am UTC](https://community.hubspot.com/t/trouble-validating-workflow-webhook-signature/15372/6 "2019-07-23T02:19:51Z")

</div>

@WendyGoh after playing around with it a bit more I got it to work. Not sure what I did differently but it works now.

Thank you!