The original title is "How to Verify Square Webhook Signatures (and the Notification-URL Trap)"

Short summary

A technical guide to verifying Square webhook signatures, which are HMAC-SHA-256 computed over the notification URL concatenated with the raw request body. The two main traps are reconstructing the URL from request headers (which can differ from the registered URL) and parsing JSON before verification (which changes the bytes). Includes Node.js/Express code using constant-time comparison.

• •Square webhook signatures include the notification URL in the HMAC payload, not just the body
• •Never reconstruct the URL from request headers; use the exact registered URL as a constant
• •Always verify against the raw body before JSON parsing; use crypto.timingSafeEqual for comparison

Generated with AI, which can make mistakes.