# Validating CRM Action Hooks

**URL:** <https://community.hubspot.com/t/validating-crm-action-hooks/76918>\
**Category:** APIs & Integrations\
**Tags:** webhooks\
**Created:** [March 10, 2023, 10:12am UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918 "2023-03-10T10:12:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan9](https://avatars.discourse-cdn.com/v4/letter/d/e8c25b/32.png) [@dan9](https://community.hubspot.com/u/dan9)\
**Post date:** [March 10, 2023, 10:12am UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918/1 "2023-03-10T10:12:31Z")

</div>

I’ve got an action hooks that looks like this:

```lia-code-sample
{
 type: 'ACTION_HOOK',
 httpMethod: 'POST',
 uri: 'https://xxx.eu.ngrok.io/api/powerups/hubspot/card',
 label: 'Some Value',
}

```

When selecting that value, Hubspot fires of a POST request and waits for it to return a 200 on my side. Once it has done that, it fires for a GET request to me again.

The problem I have is that the GET request validates just fine, but the POST doesn’t. Leading me to believe it’s not my code that’s wrong, but somehow validating action hooks work differently.

My code:

```lia-code-sample
 // v3
 const hmac = crypto.createHmac(
 'sha256',
 process.env.HUBSPOT_CLIENT_SECRET!
 );
 let str: string;
 if (method === 'POST') {
 str = method! + url + JSON.stringify(body) + Number(timestamp);
 } else {
 str = method! + url + Number(timestamp);
 }
 const hash = hmac.update(str).digest('base64');

 // v2
 if (method === 'POST') {
 str = clientSecret + method! + url + JSON.stringify(body);
 } else {
 str = clientSecret + method! + url;
 }
 const hash2 = crypto.createHash('sha256').update(str).digest('hex');

```

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [March 13, 2023, 2:50pm UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918/2 "2023-03-13T14:50:11Z")

</div>

Hi, @dan9 👋 Thanks for reaching out. Were you able to make any progress here? If not, we can tag a few community members and try to get the conversation going.

Best,

Jaycee

---

<div class="post-metadata">

**Author:** ![dan9](https://avatars.discourse-cdn.com/v4/letter/d/e8c25b/32.png) [@dan9](https://community.hubspot.com/u/dan9)\
**Post date:** [March 13, 2023, 2:54pm UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918/3 "2023-03-13T14:54:54Z")

</div>

No, I didn’t unfortunately. Please tag some people.

---

<div class="post-metadata">

**Author:** ![hyago\_alves](https://avatars.discourse-cdn.com/v4/letter/h/3ab097/32.png) [@hyago\_alves](https://community.hubspot.com/u/hyago_alves)\
**Post date:** [May 13, 2024, 5:46pm UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918/4 "2024-05-13T17:46:54Z")

</div>

I am facing a similar issue. I have a public application and I noticed that signature validation is working correctly on GET requests and Webhooks. However, when dealing with **ACTION HOOK** , signature validation appears to fail as the received signature is different from what was expected.  
I believe it’s a bug on Hubspot itself.

---

<div class="post-metadata">

**Author:** ![dan9](https://avatars.discourse-cdn.com/v4/letter/d/e8c25b/32.png) [@dan9](https://community.hubspot.com/u/dan9)\
**Post date:** [March 23, 2023, 3:39pm UTC](https://community.hubspot.com/t/validating-crm-action-hooks/76918/5 "2023-03-23T15:39:06Z")

</div>

Ended up using a GET request for this. I also successfully validated a webhook with a POST request so surely this must be a bug.