# Authenticating Webhooks

This feature ensures secure communication between Agency Handy and external systems. By setting up authentication, you can protect data transmission and ensure that only authorized endpoints receive webhook data.

### **Benefits**

* **Security:** Protect sensitive data from unauthorized access.
* **Reliability:** Ensure that webhook data is only sent to and received by authorized endpoints.
* **Compliance:** Meet security and compliance requirements for data transmission.

### **Steps to Use**

#### To Set Up Webhook verification

We highly recommend verifying the webhooks that you receive in your endpoint. You can verify the webhook in the following way:

### Verify Webhook

<mark style="color:green;">`POST`</mark> /api/v1/webhooks/verify-signature

**Headers (required)**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**Body(required)**

| Name        | Type   | Description              |
| ----------- | ------ | ------------------------ |
| `webhookId` | string | Webhook Id               |
| `signature` | string | signature of the webhook |
| `secret`    | string | webhook secret           |
| `payload`   | object | webhook payload          |

You can find webhookId after you have created a webhook.

<figure><img src="https://842362573-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiedbxyF6rrnGBuHuFME1%2Fuploads%2F6B1dzG5WwEFCw60J24YU%2Fimage.png?alt=media&#x26;token=ae06f9e9-caf4-4511-a836-d12d7550e049" alt=""><figcaption></figcaption></figure>

You can get the webhook signature from the request header named.

`x-ah-sig`

You can get the webhook secret after you have created a webhook. You can find the payload in the request body on the sidebar webhook secret.

<figure><img src="https://842362573-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiedbxyF6rrnGBuHuFME1%2Fuploads%2F0bdSCRMLjg9pqi6ThQZs%2Fimage.png?alt=media&#x26;token=d47052a5-386a-4304-b977-e822e21e2bc5" alt=""><figcaption></figcaption></figure>

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
    "verification_status": "SUCCESS"
}
```

{% endtab %}

{% tab title="403" %}

```json
{
    "type": "PermissionError",
    "status": 403,
    "verification_status": "FAILED"
}
```

{% endtab %}
{% endtabs %}

**Example:**

{% tabs %}
{% tab title="JavaScript" %}

```javascript

const url = 'https://api.agencyhandy.com/api/v1/webhooks/verify-signature';
const postData = {
  webhookId: 'your_webhook_id',
  signature: 'your_signature',
  secret: 'your_webhook_secret',
  payload: {}, // Your payload object here
};

try {
  const response = await fetch(url, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(postData),
  });

  const data = await response.json();
  console.log('Success:', data);
} catch (error) {
  console.error('Error:', error);
}
```

{% endtab %}

{% tab title="cURL" %}

```bash

curl -X POST https://api.agencyhandy.com/api/v1/webhooks/verify-signature \
     -H "Content-Type: application/json" \
     -d '{
           "webhookId": "your_webhook_id",
           "signature": "your_signature",
           "secret": "your_webhook_secret",
           "payload": {}
         }'
```

{% endtab %}
{% endtabs %}

### **Important Notes**

* **Token Management:** Keep the token secure and change it periodically to maintain security.
* **Endpoint Security:** Ensure the endpoint URL is secure and can validate the token.
* **Regular Monitoring:** Monitor the webhook activity to detect any unauthorized access attempts.
* **Documentation:** Maintain a record of the authentication tokens and their corresponding endpoints for reference and troubleshooting.