Soenneker.Webhooks.Signing 4.0.2

Prefix Reserved

There is a newer version of this package available.
See the version list below for details.

dotnet add package Soenneker.Webhooks.Signing --version 4.0.2

NuGet\Install-Package Soenneker.Webhooks.Signing -Version 4.0.2

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="Soenneker.Webhooks.Signing" Version="4.0.2" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="Soenneker.Webhooks.Signing" Version="4.0.2" />
                    

                            Directory.Packages.props

<PackageReference Include="Soenneker.Webhooks.Signing" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add Soenneker.Webhooks.Signing --version 4.0.2

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: Soenneker.Webhooks.Signing, 4.0.2"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package Soenneker.Webhooks.Signing@4.0.2

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=Soenneker.Webhooks.Signing&version=4.0.2
                    

                            Install as a Cake Addin

#tool nuget:?package=Soenneker.Webhooks.Signing&version=4.0.2
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Soenneker.Webhooks.Signing

A .NET utility for securely signing outgoing webhooks using the Standard Webhooks specification.

Implements the symmetric HMAC-SHA256 signing scheme from the Standard Webhooks specification.

Installation

dotnet add package Soenneker.Webhooks.Signing

Usage

services.AddWebhooksSigningUtilAsSingleton();

Generate a Standard Webhooks secret once and store it securely:

string secret = signingUtil.GenerateSecret();
// whsec_<base64-encoded 32-byte key>

Pass an object to Create. It is serialized once with JsonUtil.SerializeToUtf8Bytes, and the returned byte array is the exact payload that was signed:

const string webhookId = "msg_2KWPBgLlAfxdpx2AI54pPJ85f4W";
DateTimeOffset attemptTime = DateTimeOffset.UtcNow;

var webhook = new
{
    Type = "contact.created",
    Data = new { Id = "abc" }
};

SignedWebhook signed = signingUtil.Create(
    webhookId,
    attemptTime,
    webhook,
    secret);

foreach ((string name, string value) in signed.Headers.ToDictionary())
    request.Headers.TryAddWithoutValidation(name, value);

request.Content = new ByteArrayContent(signed.Payload);
request.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json")
{
    CharSet = "utf-8"
};

The generated headers follow the Standard Webhooks symmetric signature scheme:

webhook-id: msg_2KWPBgLlAfxdpx2AI54pPJ85f4W
webhook-timestamp: 1674087231
webhook-signature: v1,<base64 HMAC-SHA256 signature>

For zero-downtime secret rotation, pass all active secrets to Create. The resulting webhook-signature header contains the signatures separated by spaces:

SignedWebhook signed = signingUtil.Create(
    webhookId,
    attemptTime,
    webhook,
    [currentSecret, previousSecret]);

String and byte overloads are also available when the payload is already serialized. Payload bytes are signed exactly; do not parse and reserialize the body between signing and sending:

string signature = signingUtil.Sign(webhookId, unixTimestamp, payloadBytes, secret);

Product	Compatible and additional computed target framework versions.
.NET	net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed.

Compatible target framework(s)

Included target framework(s) (in package)

Learn more about Target Frameworks and .NET Standard.

net10.0
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.10)
- Soenneker.Extensions.Arrays.Bytes (>= 4.0.61)
- Soenneker.Extensions.String (>= 4.0.707)
- Soenneker.Utils.Json (>= 4.0.2601)

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version	Downloads	Last Updated
4.0.4	0	7/30/2026
4.0.3	54	7/28/2026
4.0.2	32	7/28/2026
4.0.1	36	7/28/2026