HMAC-SHA256 · hex · no timestamp

Sentry

Sentry integration webhooks, signed like GitHub with a bare hex digest.

Try it, live in your browser

import { verify } from "hooksig";

const result = await verify("sentry", {
  payload: rawBody,            // the RAW body, not parsed JSON
  headers: request.headers,
  secret: env.WEBHOOK_SECRET,
});

if (!result.verified) {
  return new Response(result.reason, { status: 400 });
}

The scheme

• HeaderSentry-Hook-Signature
• AlgorithmHMAC-SHA256
• Encodinghex
• Timestampnone, add your own if you need it
• SignsHMAC-SHA256 over the raw body, hex-encoded, bare digest with no prefix, keyed by the integration client secret. No timestamp.

Gotchas

• The header is the bare hex digest, with no sha256= prefix.
• The key is your integration's client secret, not the DSN or an auth token.
• Sign the RAW body. Re-stringified JSON changes bytes and every check fails.
• Sentry also sends the older sentry-hook-signature over an empty body for the install ping; verify against the actual raw body you received.

Official Sentry docs →