HMAC-SHA1 · base64 · no timestamp

MongoDB Atlas

Atlas alert webhooks are a SHA-1 holdout: base64 over the raw body, in an X-MMS-Signature header.

Try it, live in your browser

import { verify } from "hooksig";

const result = await verify("atlas", {
  payload: rawBody,            // the RAW body, not parsed JSON
  headers: request.headers,
  secret: env.WEBHOOK_SECRET,
});

if (!result.verified) {
  return new Response(result.reason, { status: 400 });
}

The scheme

• HeaderX-MMS-Signature
• AlgorithmHMAC-SHA1
• Encodingbase64
• Timestampnone, add your own if you need it
• SignsHMAC-SHA1 over the raw body, base64-encoded, keyed by the webhook secret. No timestamp.

Gotchas

• It is SHA-1, not SHA-256. Atlas, Twilio, and Vercel are the SHA-1 holdouts here.
• The digest is base64, not hex, and the header carries it bare with no prefix.
• Atlas only sends X-MMS-Signature when you set a secret in the Webhook Secret field. No secret means no signature to check.
• Sign the RAW body. No timestamp is signed, so add your own replay protection if you need it.

Official MongoDB Atlas docs →