Skip to main content
Klaviyo signs each webhook with HMAC-SHA256, carried in the klaviyo-signature header. Register the credential on your endpoint and webhook.co verifies every captured request against the exact bytes it received, then records the outcome — with a named reason when it fails.

​
Get the secret key

You choose this value yourself when creating the webhook rather than Klaviyo generating it, either in the create-webhook form or as the secret_key field on the API request. See Klaviyo’s own webhook documentation for the current steps. It must be at least 16 characters, and Klaviyo never returns it afterwards, so record it as you create the webhook.

​
Register it on your endpoint

​
How the signature is checked

  • Signed message — {body}{timestamp}.
  • Algorithm — HMAC-SHA256, hex-encoded.
  • Key — the signing secret used verbatim (its UTF-8 bytes).
  • Signature format — the bare encoded MAC.
  • Timestamp — read from the klaviyo-timestamp header.

​
What makes this one different

  • The timestamp is part of the signed message, but no replay-age window is enforced.

​
Confirm

A request whose signature matches shows verified; one that does not shows failed, with the reason named.