Menu

Webhook Headers & Authentication

 When sending data from Flarie to external systems, it is important to secure your webhook requests. Flarie provides flexible authentication options and full control over request headers to help protect your integrations. 

Request configuration

You can choose how your webhook requests are authenticated.

None

No authentication is included in the request.Use this only for public endpoints or testing.

Flarie authentication (recommended)

Automatically includes your API Access Key as a Bearer token.Authorization: Bearer <accessKey>This ensures requests can be verified as coming from Flarie.

TipValidate this token on your server to confirm the request source.

Custom authentication

Use this when your endpoint requires specific credentials.Basic authEnter a username and password. These are encoded and sent as:Authorization: Basic <base64(username:password)>Bearer tokenEnter a token that will be sent as:Authorization: Bearer <your_token>

 

Custom headers

You can add additional headers to your webhook request.

  1. Click Add Header +.
  2. Enter a header name and value.

Example:Header name: x-api-keyHeader value: 12345-ABCDEThis will be sent with the request and can be used for authentication or metadata.You can combine custom headers with any authentication method.

 

X-Signature header (optional)

Learn how to enable Secret Key in Flarie Studio hereFor additional security, you can enable the X-Signature header.When enabled, each request includes a signature:

X-Signature: <HMAC-SHA256 signature>

This signature is generated using HMAC-SHA256 with your Secret Key and the request payload.

It allows you to verify that:

  • The request is from Flarie
  • The payload has not been modified

Verify signature (example)

const crypto = require("node:crypto");

// Example payload (exact JSON string from the request body)
const payload = // your json payload from the webhook
const payloadString = JSON.stringify(payload);

// Your Secret Key from Flarie Studio
const secretKey = "your-secret-key";

// Generate the expected HMAC-SHA256 signature
const calculatedSignature = crypto
.createHmac("sha256", secretKey)
.update(payloadString)
.digest("hex");

// Compare with the X-Signature from the request header
const xSignature = "X-Signature-in-the-header";

if (xSignature === calculatedSignature) {
console.log("✅ Payload is authentic and unmodified")
} else {
console.log("⚠️ Payload is modified")
}

Recommendation

Using authentication together with X-Signature verification provides the highest level of security for your webhook integrations.

Need additional help setting up your integration? Contact Us