# How to verify Webhook Signature with PHP script

**URL:** https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382
**Category:** ⚙️ API
**Tags:** disburse-api, collect-api
**Created:** [January 14, 2022, 10:45am UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382 "2022-01-14T10:45:41Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Ha\_Tr\_n](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/ha_tr_n/32/1457_2.png) [@Ha\_Tr\_n](https://community.rapyd.net/u/Ha_Tr_n)
#### Post date: [January 14, 2022, 10:45am UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382/1 "2022-01-14T10:45:41Z")

</div>

i read this document [calculation signature](https://docs.rapyd.net/build-with-rapyd/reference/webhooks#calculation-of-signature) and caculate signature

My source code like this

```auto
        $accessKey = <my_access_key>;
        $secretKey = <my_secret_key>;
        $urlPath = <my_entire _url>; // example: https://test.com
        $salt = $request->header('salt', null);
        $timestamp = $request->header('timestamp', null);
        $body = $request->all();

        $bodyString = $body && !is_null($body) ? json_encode($body, JSON_UNESCAPED_SLASHES) : '';
        $signatureString = "$path$salt$timestamp$accessKey$secretKey$bodyString";
        $hashSignature = hash_hmac("sha256", $signatureString, $secretKey);
	    $signature = base64_encode($hashSignature);

```

But my caculator signature is not compare with signature of Rapyd webhook header. Please help me answer why?  
Thank for support!

---

<div class="post-metadata">

### Author: ![Community\_Team](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@Community\_Team](https://community.rapyd.net/u/Community_Team)
#### Post date: [January 18, 2022, 7:04pm UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382/2 "2022-01-18T19:04:30Z")

</div>

Thanks @Ha_Tr_n. This can happen if our body string is different. The $body\_string format should be JSON format, but in the format of a string with no spaces.

For example, if the body is: `{ "hello": "world" }`

It should encoded to a string as: `{"hello":"world"}`

I do suggest creating a ticket at [https://support.rapyd.net](https://support.rapyd.net/) and our support team can help you with all of your sensitive information.

---

<div class="post-metadata">

### Author: ![Ha\_Tr\_n](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/ha_tr_n/32/1457_2.png) [@Ha\_Tr\_n](https://community.rapyd.net/u/Ha_Tr_n)
#### Post date: [January 20, 2022, 3:20am UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382/3 "2022-01-20T03:20:40Z")

</div>

Thank @Community_Team. I checked my body string, but i think “string with no spaces” is not the correct reason.

i send a request to your support team. Hope you help me resolve my issue.

Best Regards,  
Ha

---

<div class="post-metadata">

### Author: ![Community\_Team](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@Community\_Team](https://community.rapyd.net/u/Community_Team)
#### Post date: [January 24, 2022, 6:45pm UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382/4 "2022-01-24T18:45:18Z")

</div>

Thanks @Ha_Tr_n, how’s it going? Have you tried using the [Request Signatures](https://docs.rapyd.net/build-with-rapyd/reference/message-security#request-signatures) example:

```auto
$body = array(); // JSON body goes here. Always empty for GET; 
                                     // strip nonfunctional whitespace.
$body_string = json_encode($body);

```

Compared to:

```auto
$body = $request->all();

$bodyString = $body && !is_null($body) ? json_encode($body, JSON_UNESCAPED_SLASHES) : '';

```

---

<div class="post-metadata">

### Author: ![CharlesDorsett](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/charlesdorsett/32/47_2.png) [@CharlesDorsett](https://community.rapyd.net/u/CharlesDorsett)
#### Post date: [February 1, 2022, 4:58pm UTC](https://community.rapyd.net/t/how-to-verify-webhook-signature-with-php-script/1382/5 "2022-02-01T16:58:04Z")

</div>

Just an update here - after asking around a lot, I discovered that there are 2 issues that can mess up the string that is hashed:

- All spaces and other whitespace outside of strings must be removed.
- Numbers should be sent in strings, not as numbers.