> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitforms.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Security

> Verify webhook signatures to ensure requests are genuinely from OrbitForms and haven't been tampered with.

## Signature Header

Every webhook request includes a signature in the `X-Orbit-Signature` header:

```
X-Orbit-Signature: sha256=abc123def456...
```

## Verification Example

Here's how to verify the signature in Node.js:

```javascript theme={null}
const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  
  const expected = `sha256=${expectedSignature}`;
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Usage in Express
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-orbit-signature'];
  const isValid = verifyWebhookSignature(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook...
  res.status(200).send('OK');
});
```

<Warning>
  **Important**

  Always verify the signature before processing webhook data. Never trust webhook payloads without verification.
</Warning>

## Webhook Secret

Your webhook secret is available in your dashboard under **Settings → Webhooks**. If you suspect it has been compromised, you can regenerate it at any time.

* Store the secret in environment variables
* Never commit secrets to version control
* Rotate secrets periodically for security

[Next: Embed Script →](/developers/embed)