Webhook Signing and Delivery

#Webhook signing

By default when add a new webhook, the system will provide you with a secret key. This key is used to create a signature for the payload sent over from our API.

We recommend that you validate the requests sent by the webhook to make sure that the data came from us and wasn't tamped with.

You can find the signature for the payload under a header called tracksim-signature, this signature is a hash generated by the payload. Below is an example in Python on how we generate our signatures.

import json, hmac, hashlib

data = json.dumps(request.data)
secret = "<webhook_secret>"
signature = hmac.new(secret.encode(), msg=data.encode(), digestmod=hashlib.sha256).hexdigest()

Using the following python you can verify the signature created matches:

import json, hmac, hashlib

data = json.dumps(request.data)
secret = "<webhook_secret>"
signature = hmac.new(secret.encode(), msg=data.encode(), digestmod=hashlib.sha256).hexdigest()

if signature == request.headers['tracksim-signature']:
  print("The Signature matches")

request.data is the payload of JSON received when by the POST method request.

secret is the key generated when connecting an settings page

hmac.new is the python function which generates the hash signature found in header tracksim-signature.

#Webhook retry system

Our system is designed to retry sending webhooks up to 3 times if the webhook fails to send.

After each try the delay is increased before trying again:

• first attempt: 5 minute delay
• second attempt: 10 minute delay
• third and final attempt: 20 minute delay

Our the third attempt our system won't try again automatically. You can manually resend the webhook via the portal if you wish.

We will consider all HTTP status codes in the 200 range as a successful attempt. If you return any other status code, we will mark the webhook as failed and try again later.

You can see the history of all webhooks sent in your webhook log on the settings game.