Api Design medium
Your API sends webhooks to customer endpoints. How do customers verify the webhook is genuinely from you?
- A Sign the payload with an HMAC-SHA256 signature using a shared secret and include the resulting digest in a custom request header for verification.
- B Verify the sender's origin IP address against a publicly published list of the service provider's static IP ranges or CIDR blocks.
- C Require the webhook sender to provide standard HTTP Basic Authentication credentials that are unique to each customer's receiver endpoint.
- D Rely on the inherent encryption provided by the TLS handshake to ensure that the webhook data was not intercepted or altered during transit.
Answer: A. Sign the payload with an HMAC-SHA256 signature using a shared secret and include the resulting digest in a custom request header for verification.
To secure webhooks, the sender computes an **HMAC (Hash-based Message Authentication Code)** of the payload using a secret shared with the receiver. This signature is sent in a header (e.g., `X-Hub-Signature`). The receiver re-computes the HMAC and compares it. This guarantees that the payload originated from the sender (authenticity) and hasn't been tampered with (integrity).
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You're designing a REST API for a blog. Which endpoint best represents 'get all comments for post 123'?
- A client wants to update only the 'status' field of an order, leaving other fields unchanged. Which HTTP method is most appropriate?
- A client calls POST /users with valid data, and the user is created. What status code should the server return?
- A client retries a failed 'POST /payments' request due to network timeout. The server receives the request twice. Without idempotency handling, what can happen?
- An API returns 10,000 products. Returning all in one response is impractical. Which pagination approach is simple and stateless?
- Your API serves both mobile apps and third-party integrations. Which authentication method is most appropriate?