# Validate the v3 request signature HUBSPOT using PHP

**URL:** <https://community.hubspot.com/t/validate-the-v3-request-signature-hubspot-using-php/78049>\
**Category:** APIs & Integrations\
**Tags:** php, webhooks\
**Created:** [March 27, 2023, 8:11am UTC](https://community.hubspot.com/t/validate-the-v3-request-signature-hubspot-using-php/78049 "2023-03-27T08:11:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SFlorina](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@SFlorina](https://community.hubspot.com/u/SFlorina)\
**Post date:** [March 27, 2023, 8:11am UTC](https://community.hubspot.com/t/validate-the-v3-request-signature-hubspot-using-php/78049/1 "2023-03-27T08:11:24Z")

</div>

I am trying to connect a Hubspot CRM with my internal application, to send values from Hubspot to my app using Webhooks, with Authentication: Hubspot app id. But the HTTP\_X\_HUBSPOT\_SIGNATURE\_V3 does not match my hashed string.

Here is the code:

```auto
<?php $request_method = $_SERVER['REQUEST_METHOD']; //returns: POST
$request_uri = $_SERVER['REQUEST_URI']; // returns: /hubspot/webhook.php
$request_body = file_get_contents('php://input'); 
//returns: {"email":"test@gmail.com","field1":null,"field2":null,"field3":null,"field4":null}
$request_timestamp = $_SERVER['HTTP_X_HUBSPOT_REQUEST_TIMESTAMP'];// returns: 1679654017505
$string = utf8_encode("{$request_method}{$request_uri}{$request_body}{$request_timestamp}"); //POST/hubspot/webhook.php{"email":"test@gmail.com","field1":null,"field2":null,"field3":null,"field4":null}1679654017505
$HUBSPOT_APP_SECRET = '...';
$hash = hash_hmac('sha256', $string, $HUBSPOT_APP_SECRET, true); //returns odd characters
$encoded = base64_encode($hash);
$valid = hash_equals($_SERVER['HTTP_X_HUBSPOT_SIGNATURE_V3'], $encoded);
if($valid == 1) {
 echo 'yes';
}else {
 echo 'no';
}?>

```

In the end, it returns ‘no’. I do not understand what I am doing wrong. Please help!

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [March 28, 2023, 4:22pm UTC](https://community.hubspot.com/t/validate-the-v3-request-signature-hubspot-using-php/78049/2 "2023-03-28T16:22:54Z")

</div>

Hey, @SFlorina 👋 Thanks for reaching out. One place to get started is this post from our community member @tominal — [PHP and v3 Signature.](https://community.hubspot.com/t5/APIs-Integrations/Workflow-webhook-signature-validation-sha256-produced-by-my-code/m-p/721247/highlight/true#M58950)

Best,

Jaycee

---

<div class="post-metadata">

**Author:** ![SFlorina](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@SFlorina](https://community.hubspot.com/u/SFlorina)\
**Post date:** [March 29, 2023, 6:59am UTC](https://community.hubspot.com/t/validate-the-v3-request-signature-hubspot-using-php/78049/3 "2023-03-29T06:59:59Z")

</div>

Hello. Thank you for the answer.

I read the post you gave me, and I modified my code to look like the one in that post. Still not working well.

\<?php  
$document = ‘POSThttps://www…/hubspot/webhook.php{“[email":"test@test.com](mailto:email%22:%22test@test.com)”,“field1”:null,“field1”:null,“field1”:null,“field1”:null}1679654017505’;  
$secret = ‘pat-eu1-..’;  
$hash = hash\_hmac(‘sha256’, $document, $secret, true);

$encoded = base64\_encode($hash);  
$valid = hash\_equals($\_SERVER[‘HTTP\_X\_HUBSPOT\_SIGNATURE\_V3’], $encoded);  
if($valid == 1) {  
echo ‘yes’;  
}else {  
echo ‘no’;  
}  
?\>

But I understand that the secret key that the client gave me and starts with ‘pat-eu1’ in not the right key, ‘The secret keys the documentation is referring to are developer apps where you are given a client ID and client secret key.’.

I will ask for the proper key and I will try again.

Thank you!