> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gork.email/llms.txt
> Use this file to discover all available pages before exploring further.

# HMAC Signatures

> Cryptographic webhook verification using HMAC-SHA256.

## X-Gork-Signature Header

Every inbound webhook includes an `X-Gork-Signature` HTTP header formatted as:

```http theme={null}
X-Gork-Signature: t=1725700000,v1=9a8b7c6d5e4f...
```

* `t`: Unix timestamp in seconds.
* `v1`: Hex-encoded HMAC-SHA256 signature calculated over `${t}.${rawBody}` using your endpoint's signing secret.

## Verifying in TypeScript

```typescript theme={null}
import crypto from "crypto"

export function verifyGorkWebhook(
  rawBody: string,
  signatureHeader: string,
  secret: string
): boolean {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("="))
  )
  const timestamp = parts.t
  const signature = parts.v1

  // Guard against replay attacks older than 5 minutes
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return false
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}
```