How would you verify a webhook signature and prevent replay in a Python API?

Verifies provider signatures over raw bytes, enforces freshness, and makes repeated delivery idempotent.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I read the raw request bytes and verify the provider's signature with the configured endpoint secret before parsing or acting on the payload. For HMAC signatures I compute the expected digest with the documented algorithm and compare it with hmac.compare_digest. I reject missing, malformed, or invalid signatures with a generic response. Re-serializing parsed JSON is wrong because whitespace and field order can change the signed bytes.

Full answer below

Practice focus

Verifies provider signatures over raw bytes, enforces freshness, and makes repeated delivery idempotent.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Verifies provider signatures over raw bytes, enforces freshness, and makes repeated delivery idempotent.
I read the raw request bytes and verify the provider's signature with the configured endpoint secret before parsing or acting on the payload. For HMAC signatures I compute the expected digest with the documented algorithm and compare it with hmac.compare_digest. I reject missing, malformed, or invalid signatures with a generic response. Re-serializing parsed JSON is wrong because whitespace and field order can change the signed bytes.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A valid signature proves authenticity and integrity, but a captured valid request may still be replayed. When the provider signs a timestamp, I enforce a bounded tolerance with a synchronized clock. I also store the provider's delivery or event id under a unique constraint so retries produce the same result rather than duplicate side effects. Signature validation happens before expensive parsing or queueing.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Parsing and re-encoding JSON before verification
Treating a valid signature as replay protection
Doing irreversible work before deduplication

How would you verify a webhook signature and prevent replay in a Python API?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?