Skip to main content

Webhook Signature Verification

HMAC-SHA256 payload signing

Every outbound webhook includes an X-Gatekeeper-Signature header. Compute an HMAC-SHA256 digest of the raw request body using your signing secret and compare it in constant time.

verify-webhook.js
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const computed = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(computed)
  );
}

Quickstart Guides

Get running in under 15 minutes

  • First network scan
  • CMDB setup
  • SIEM integration
  • Compliance mapping
  • Agent deployment

Migration Guides

Switch from legacy tooling

  • From Lansweeper
  • From ServiceNow CMDB
  • From Nagios/Zabbix
  • From Splunk SIEM

Ready to build?

Start integrating with the Gatekeeper API today

Explore the full developer platform or choose a plan that fits your team.

Cookie Preferences

We use cookies to ensure the platform works correctly, remember your settings, and improve your experience.

© B-Brave Gatekeeper 2026