diff --git a/webhooks/security.mdx b/webhooks/security.mdx index ca0b8d25f..e0bd3420d 100644 --- a/webhooks/security.mdx +++ b/webhooks/security.mdx @@ -27,14 +27,14 @@ Each webhook request includes an `X-Firecrawl-Signature` header: X-Firecrawl-Signature: sha256=abc123def456... ``` -### How to Verify +To verify a request: -1. Extract the signature from the `X-Firecrawl-Signature` header -2. Get the raw request body (before parsing) -3. Compute HMAC-SHA256 using your secret key -4. Compare signatures using a timing-safe function +1. Extract the signature from the `X-Firecrawl-Signature` header. +2. Read the raw request body before parsing. +3. Compute HMAC-SHA256 using your secret key. +4. Compare signatures with a timing-safe function. -### Implementation +### Example