> For the complete documentation index, see [llms.txt](https://docs.shredpay.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.shredpay.xyz/developers/webhooks/signature-verification.md).

# Signature Verification

Outline:

* Header carrying the signature (e.g. `X-ShredPay-Signature`).
* Algorithm: HMAC-SHA256 over `<timestamp>.<raw body>`.
* Per-endpoint signing secret (different from the API key).
* Pseudocode for verification.
* Replay protection: reject if `timestamp` is older than 5 minutes.
* Sample implementations in Node, Python, Go.