Skip to main content

Signature Verification

The signature must be used to verify if the request has not been tampered with. To verify the signature at your end, you will need your Cashfree PG secret key along with the payload. Timestamp is present in the header: x-webhook-timestamp
timestamp := 1617695238078;
signedPayload := timestamp.timestamp.payload; expectedSignature := Base64Encode(HMACSHA256(signedPayload,signedPayload, merchantSecretKey));