Webhook Authentication

When integrating with external systems, security is key, especially when sensitive user data is involved. To ensure your webhooks are both trusted and protected, Flarie offers a simple yet powerful authentication method using your account’s Access Key and Secret Key.

In this guide, you’ll learn how to securely authenticate your webhooks step-by-step. By following best practices for authentication, you can be confident that your data integrations are safe, verified, and reliable - every time an event is triggered in your Game or Game Center.

Whether you're connecting to internal systems or third-party platforms, this setup gives you the tools to ensure that only authorized sources are calling your endpoints—keeping your data secure and your integrations trustworthy.

 

Enable API Access Key in Flarie Studio (recommended)

Learn how to enable API Access Key in Flarie Studio here

When the API Access Key feature is enabled, every webhook request sent from Flarie will automatically include a Bearer token in the Authorization header, formatted like this:

Authorization: Bearer <accessKey>

While verifying this token on your endpoints is optional, it’s highly recommended. Adding this check gives you an extra layer of security by ensuring that incoming requests are genuinely from Flarie, and not from an unauthorized source attempting to mimic our system.

 

 

Enable Secret Key in Flarie Studio (optional)

Learn how to enable Secret Key in Flarie Studio here

When the Secret Key is enabled, every webhook request sent from Flarie will automatically include the X-Signature in the header. 

X-Signature: <HMAC-SHA256 signature>

This X-Signature is a SHA-256 HMAC (Hash-based Message Authentication Code), generated by hashing the raw JSON payload using your account’s Secret Key. It serves as a digital signature, allowing you to validate both the integrity and authenticity of the webhook request and data.

By recalculating the signature on your end and comparing it to the one sent in the header, you can be sure the payload hasn’t been tampered with - and that it genuinely came from Flarie.

Here’s a simple Node.js example to verify the signature:

const crypto = require("node:crypto");

// Example payload (exact JSON string from the request body)
const payload = // your json payload from the webhook
const payloadString = JSON.stringify(payload);

// Your Secret Key from Flarie Studio
const secretKey = "your-secret-key";

// Generate the expected HMAC-SHA256 signature
const calculatedSignature = crypto
  .createHmac("sha256", secretKey)
  .update(payloadString)
  .digest("hex");

// Compare with the X-Signature from the request header
const xSignature = "X-Signature-in-the-header";

if (xSignature === calculatedSignature) {
  console.log("✅ Payload is authentic and unmodified")
} else {
  console.log("⚠️ Payload is modified")
}

Adding this verification step is optional—but highly recommended for any critical or sensitive integrations.

 

Need additional help setting up your integration? Contact Us