APS Webhook Signature Verification Samples

Code snippets for verifying the HMAC-SHA1 signature that Autodesk Platform Services (APS) attaches to every webhook delivery.

Implementing signature verification protects your webhook endpoint from spoofed requests: only payloads that were genuinely sent by APS (and have not been tampered with in transit) will produce a matching signature.

---

How APS webhook signatures work

┌────────────┐   POST /webhook                          ┌────────────────┐
│    APS     │ ─────────────────────────────────────►  │  Your server   │
│  (sender)  │  Headers:                                │  (receiver)    │
│            │    x-adsk-signature: sha1hash=<hex>       │                │
│            │  Body: <raw JSON payload>                │                │
└────────────┘                                          └────────────────┘

1. APS computes HMAC-SHA1(raw_body, webhook_secret) using the secret you chose when creating the webhook subscription.
2. APS hex-encodes the result and sends it in the x-adsk-signature header with the prefix sha1hash=.
3. You save the raw payload to sample.json and the x-adsk-signature header value to RECEIVED_HASH in the .env file.
4. The CLI tool reads the raw bytes of the payload and re-computes the same HMAC using the same secret.
5. It compares the two values with a constant-time (timing-safe) comparison function to prevent timing-based attacks.
6. If they match the payload is authentic.

Important: The payload in sample.json must be the exact raw bytes received. Do not re-format or re-serialize the JSON, as even whitespace changes will break the HMAC comparison.

---

Troubleshooting

If the signature comes back as INVALID, check the following:

Issue	Symptom	Fix
Line endings	On Windows, editors save files with CRLF (\r\n), but APS sends payloads with LF (\n). The extra \r bytes change the HMAC entirely.	The CLI tools automatically normalize CRLF to LF before computing the hash. If you process the payload in your own code, make sure to do the same.
Reformatted JSON	Pretty-printing, re-serializing, or minifying the payload changes whitespace, key order, or numeric formatting.	Always use the raw body bytes exactly as received. Do not run the JSON through a parser/serializer round-trip. APS (Java/Jackson) sends payloads with " : " separators and 2-space indentation -- preserve that format.
Wrong secret	The WEBHOOK_SECRET in .env doesn't match the secret used when the webhook subscription was created in APS.	Double-check the secret in the APS Webhooks dashboard.
Truncated or modified payload	The payload was edited, truncated, or had extra characters added after being captured.	Compare the byte length reported by the tool against the Content-Length header from the original delivery.

---

Samples

Folder	Language / Tool	Description
python/	Python 3.8+	Reusable helper function + CLI verification tool
javascript/	Node.js 18+	Reusable helper function + CLI verification tool
csharp/	C# / .NET 8	Reusable static helper class + CLI verification tool

Each folder contains its own README.md with setup instructions and integration guidance.

---

Quick-start

Setup

1. Copy .env.example to .env in the repo root and fill in your values:

   WEBHOOK_SECRET=your_actual_secret
   RECEIVED_HASH=sha1hash=<hex_from_x-adsk-signature_header>
   

2. Place the raw webhook payload in sample.json at the repo root.

Python

cd python
python verify_signature.py
# Payload:       .../sample.json (nnn bytes)
# Received hash: sha1hash=...
# Result:        VALID - signature matches the payload.

Node.js

cd javascript
node verifySignature.js
# Payload:       .../sample.json (nnn bytes)
# Received hash: sha1hash=...
# Result:        VALID - signature matches the payload.

C#

cd csharp
dotnet run
# Payload:       .../sample.json (nnn bytes)
# Received hash: sha1hash=...
# Result:        VALID - signature matches the payload.

Each tool also supports a --test flag to run built-in self-tests:

python verify_signature.py --test
node verifySignature.js --test
dotnet run -- --test

---

Prerequisites

Sample	Requirements
Python	Python 3.8+
Node.js	Node.js 18+
C#	.NET 8 SDK

---

Further reading

• APS Webhooks overview
• How to verify payload signature
• Secure your webhooks – blog post

---

License

This sample is licensed under the terms of the MIT License. Please see the LICENSE file for full details.

Written by

Joao Martins in/jpornelas, Developer Advocate