Assistance Needed for X-Hub-Signature Generation for Alert Webhook

Mi01_RH_DE
Mi01_RH_DE Member
in APIs & Domo Developer

We're currently working on authenticating Domo alert webhooks to trigger a pipeline in a third ETL tool and are having trouble matching the X-Hub-Signature from Domo with our computed signature. Specifically, we're unsure if we are implementing the correct algorithm for generating the signature.

Does anyone have a good idea about the exact algorithm Domo used to generate the X-Hub-Signature for the alert webhook? We want to ensure that our implementation fully aligns with the Domo webhook process for debugging.

For reference, here is the Python script we tried to compute the signature but output a different signature key than one Domo passing and thank you all in advance for your input:

import hmac

import hashlib

# Shared secret key

shared_secret = "the-shared-secret-key"

# Payload data (body of the request)

payload = b'{"name":"dag","id":"47365970","alertId":"4011","message":"","timestamp":"1728455774"}'

signature = 'sha512=' + hmac.new(shared_secret.encode(), payload, hashlib.sha512).hexdigest()

print(signature)

Answers

  • ArborRose
    ArborRose Coach

    It appears you are using the wrong hashing algorithm (SHA-512), I believe Domo's webhook uses SHA-1. Try this:

    import hmac
    
import hashlib

    
# Shared secret key
    
shared_secret = "the-shared-secret-key"

    
# Payload data (body of the request)
    
payload = b'{"name":"dag","id":"47365970","alertId":"4011","message":"","timestamp":"1728455774"}'

    
# Generate HMAC-SHA1 signature
    
signature = 'sha1=' + hmac.new(shared_secret.encode(), payload, hashlib.sha1).hexdigest()

    
print(signature)

    ** Was this post helpful? Click Agree or Like below. **
    ** Did this solve your problem? Accept it as a solution! **

  • ArborRose
    ArborRose Coach

    When comparing the signature from the X-Hub-Signature header with the computed signature, make sure you're using a secure string comparison function to prevent timing attacks.

    # Example comparison
    
received_signature = 'sha1=received-signature-from-domo'
    
is_valid = hmac.compare_digest(signature, received_signature)
    
print(is_valid)  # True if signatures match, False otherwise

    ** Was this post helpful? Click Agree or Like below. **
    ** Did this solve your problem? Accept it as a solution! **

Categories