# Firebase functions webhook validation

**URL:** https://community.rapyd.net/t/firebase-functions-webhook-validation/59003
**Category:** 🙋🏽‍♀️🙋🏽‍♂️ Ask Questions
**Created:** [November 13, 2023, 3:11pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003 "2023-11-13T15:11:04Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![blakejp1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/blakejp1/32/22319_2.png) [@blakejp1](https://community.rapyd.net/u/blakejp1)
#### Post date: [November 13, 2023, 3:11pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003/1 "2023-11-13T15:11:04Z")

</div>

I am working in a nodejs firebase functions environment. Has anybody actually been able to get the webhook verified. I can send a request ok and validation works. Its just the incoming webhook. I have a feeling it might be to do with the body encoding and firebase functions doesn’t let you get to the raw body… here is my code:  
const validateRapydSignature = (req) =\> {  
const signature = req.header(‘signature’)  
const urlPath = req.protocol + ‘://’ + req.headers.host + req.originalUrl  
const salt = req.header(‘salt’)  
const timestamp = req.header(‘timestamp’)  
const bodyString = req.body  
const secretKey = ‘…’  
const accessKey = '…

const dataToHash =  
urlPath +  
salt +  
timestamp +  
accessKey+  
secretKey+  
bodyString

let hash = crypto.createHmac(‘sha256’, secretKey)  
hash.update(dataToHash)  
const generatedSignature = Buffer.from(hash.digest(‘hex’)).toString(‘base64’)

return signature === generatedSignature  
}

---

<div class="post-metadata">

### Author: ![drew.harris](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/drew.harris/32/1259_2.png) [@drew.harris](https://community.rapyd.net/u/drew.harris)
#### Post date: [November 28, 2023, 1:39pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003/2 "2023-11-28T13:39:57Z")

</div>

Hey, @blakejp1 - are you still having this challenge? This doesn’t appear to be an issue with the Rapyd API if I am reading correctly. Can you share your logs – also is this in the production or sandbox environment of Rapyd?

---

<div class="post-metadata">

### Author: ![blakejp1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/blakejp1/32/22319_2.png) [@blakejp1](https://community.rapyd.net/u/blakejp1)
#### Post date: [November 28, 2023, 5:33pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003/3 "2023-11-28T17:33:08Z")

</div>

Hi Drew. thanks for the response. Yes I still have the challenge. I had to move on for now because I can’t solve it but obviously I need to get it solved before going live. As an update I tried it with firebase functions req.rawBody instead of just req.body and I still get the issue. I am not saying its a rapyd issue, yet :} hence the question asking if anyone actually got it working with firebase functions version 2? I am wondering if they play with the rawBody or if the encoding is different or something. Like I say I can send to rapyd with a signature fine. not sure which logs you want but will get something over to you in the next couple of days.

---

<div class="post-metadata">

### Author: ![drew.harris](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/drew.harris/32/1259_2.png) [@drew.harris](https://community.rapyd.net/u/drew.harris)
#### Post date: [November 28, 2023, 6:26pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003/4 "2023-11-28T18:26:36Z")

</div>

Sounds good. I will keep asking around if anyone else is having this challenge with Firebase and webhook validation.

---

<div class="post-metadata">

### Author: ![blakejp1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/blakejp1/32/22319_2.png) [@blakejp1](https://community.rapyd.net/u/blakejp1)
#### Post date: [November 28, 2023, 7:02pm UTC](https://community.rapyd.net/t/firebase-functions-webhook-validation/59003/5 "2023-11-28T19:02:25Z")

</div>

Appreciated. And I forgot to add: yes its in the sandbox environment and associated keys
