HMAC-SHA256 · hex · no timestamp

Notion

Notion signs its webhooks exactly like GitHub, with a verification token as the key.

Try it, live in your browser

import { verify } from "hooksig";

const result = await verify("notion", {
  payload: rawBody,            // the RAW body, not parsed JSON
  headers: request.headers,
  secret: env.WEBHOOK_SECRET,
});

if (!result.verified) {
  return new Response(result.reason, { status: 400 });
}

The scheme

• HeaderX-Notion-Signature
• AlgorithmHMAC-SHA256
• Encodinghex
• Timestampnone, add your own if you need it
• SignsHMAC-SHA256 over the raw body, hex-encoded, prefixed `sha256=`, keyed by the verification token. No timestamp.

Gotchas

• The header value is `sha256=` followed by the digest. Keep the prefix in mind when you compare.
• The key is the verification token Notion shows you once when you create the endpoint. Store it, you cannot see it again.
• Sign the RAW body. Re-stringified JSON changes bytes and every check fails.
• No timestamp is signed, so there is no built-in replay protection. Add your own if you need it.

Official Notion docs →