> ## Documentation Index
> Fetch the complete documentation index at: https://docs.govly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Security

> Learn how to secure your webhooks

# Webhook Security

Webhook requests sent from Govly are signed with your Webhook Signature Key which can be found on the API integration dashboard.

## Signature Verification

Each request will include the `Govly-Webhook-Signature` header which is a SHA2 hex digest of the webhook checksum, signed with your secret key.

To verify the signature, you can join your secret key and the webhook checksum on a period. Then, compare the result to `Govly-Webhook-Signature` to confirm the request is from Govly.

## Example Implementation

Here's an example of how you might verify a Govly webhook's authenticity in Ruby:

```ruby theme={null}
webhook_signature = webhook_request.headers["Govly-Webhook-Signature"]
webhook_checksum = webhook_request.headers["Govly-Webhook-Event-Checksum"]
webhook_signature_key = ENV["GOVLY_WEBHOOK_SIGNATURE_KEY"]

valid_signature = Digest::SHA2.hexdigest("#{webhook_signature_key}.#{webhook_checksum}")
valid = webhook_signature == valid_signature
```

## Alternative Authentication

Alternatively, you can use the custom headers option described in the Header section of the webhook documentation when creating a webhook to include a private credential of your choice to authenticate the request.