# Verifying webhooks

Source: https://www.digiparser.com/docs/guides/integrations/verifying-webhooks

Integrations

# Verifying webhooks

Make sure webhook requests really come from DigiParser.

Copy MarkdownOpen

# [Verifying webhooks](#verifying-webhooks)

Feedback

When you turn on **Webhook export** for a parser, DigiParser sends events to your endpoints through our provider, **Svix**.

Feedback

Each webhook request includes headers and is signed with a **signing secret**. You can use this to make sure:

Feedback

*   the request really came from DigiParser, and
*   the payload body was not changed in transit.

## [Find your signing secret](#1-find-your-signing-secret)

1.  Open your parser and go to **Settings -> Integrations**.
2.  Under **Added Integrations**, expand **Webhook export**, then expand the endpoint you want.
3.  You'll see a **Signing secret** value. Use **Copy** to copy it.

This secret is different for every endpoint.

app.digiparser.com![Webhook endpoint expanded showing Signing secret and Copy button](https://documents.digiparser.com/docs/screenshots/2026-07-23/webhook-export-configured-endpoint-clean.png?sig=f64197b36ca29d10c34bca839eae7b91b3e2b25e72324f96fe743e2ac51622dc)

## [Headers sent with each request](#2-headers-sent-with-each-request)

Every webhook request includes these headers:

```
svix-id: <unique message id>
svix-timestamp: <timestamp in seconds>
svix-signature: <HMAC signature>
```

Your server should:

1.  Read the raw HTTP request body as a string.
2.  Read the three headers above.
3.  Use the signing secret and headers to verify the signature.

## [Verifying in code](#3-verifying-in-code)

The easiest way to verify webhooks is to use the official Svix libraries. They handle all the details for you.

High-level steps:

1.  Install the Svix library in your backend (for example, using npm, pip, etc.).
2.  Create a `Webhook` verifier with your endpoint's signing secret.
3.  Pass the raw body and headers to the verifier.
4.  If verification fails, reject the request (e.g. return HTTP 400 or 401).

You can find language-specific examples in the Svix docs:

*   [How to verify webhooks with the Svix libraries](https://docs.svix.com/receiving/verifying-payloads/how)
*   [Manual verification details](https://docs.svix.com/receiving/verifying-payloads/how-manual)

Share those links, together with your **signing secret**, with your developer. They can plug verification into your existing server or workflow.

## [Response requirements](#4-response-requirements)

*   Respond with **2xx** (for example **200 OK**) once you've successfully received the webhook.
*   If you need to do heavy work, store the payload first and process it asynchronously so the response can be quick.

How is this guide?

GoodBad

[

Using Webhooks

Send extracted data to other systems via webhooks

](/docs/guides/integrations/using-webhooks)[

API Access

Access your data through the API

](/docs/guides/integrations/api-access)