x-zendesk-webhook-signature header. Register the credential on your endpoint and webhook.co verifies every captured request against the exact bytes it received, then records the outcome — with a named reason when it fails.
Get the signing secret key
Open the webhook in Admin Center; its secret key is hidden until you choose Reveal secret. See Zendesk’s own webhook documentation for the current steps. Zendesk issues one per webhook, and only once the webhook is fully created — while you are still creating it, the value in play is a documented static test secret.Register it on your endpoint
How the signature is checked
- Signed message —
{timestamp}{body}. - Algorithm — HMAC-SHA256, base64-encoded.
- Key — the signing secret used verbatim (its UTF-8 bytes).
- Signature format — the bare encoded MAC.
- Timestamp — read from the
x-zendesk-webhook-signature-timestampheader.
Replay window
Because the timestamp is signed, webhook.co enforces a 300-second tolerance: a request whose signed timestamp is older than that fails verification rather than being accepted as a possible replay.Confirm
verified; one that does not shows failed, with the reason named.