Unable to generate correct hash for verifying v2 hubspot signature

[ocalderon]

Hi, I'm following the following documentation: https://developers.hubspot.com/docs/api/webhooks/validating-requests for validating a request made from hubspot to my webhook endpoint. So far I've had no success. I'm following the same format (Client secret + http method + URI + request body) like this:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxposthttps://e51c-000-00-0-000.ngrok.io/url/to/webhook{"test_variable":"Test value"}

Just to consider, my app is a private app, so that I had to create a workflow to trigger the webhook. The webhook works as I'm receiving the request on my end, but I'm not being able to generate a correct hash. The way I'm generating the hash (nodejs) is the following one:

const hash = createHash('sha256').update(content).digest('hex')

I have tried the following things:

• http verb in lowercase and upper case
• as this is a private app there's no client secret, so I'm using the access token for my private app without the first portion which seems to be the same as a client secret (pat-na3-); however I have tried using the whole access token

What I'm doing wrong?

[Jaycee_Lewis · Accepted solution]

Hey, @ocalderon 👋 Private apps are incompatible with this feature. You'll need to create a public app from a developer portal to get this set up and verified. 

From the docs on Private Apps — “Please note: private apps do not support custom timeline events or webhooks. If you plan on building an app using these features, you should create a public app instead.”

I hope this helps get you moving forward! — Jaycee