Developer guide: webhook security and signature checks

Short answer: PVology-Signature is t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" with your signing secret>. Recompute it, compare in constant time, accept any v1 value (there are two during a secret rotation) and reject timestamps older than 5 minutes. Incoming webhooks to PVology use the same scheme.

Verified for PVology 0.61.0 · updated 2026-10-11