# Is the documentation for Webhook Signatures correct **URL:** \ **Category:** ⚙️ API\ **Created:** [May 7, 2021, 7:33am UTC](https://community.rapyd.net/t/is-the-documentation-for-webhook-signatures-correct/239 "2021-05-07T07:33:19Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![onesoft](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/onesoft/32/832_2.png) [@onesoft](https://community.rapyd.net/u/onesoft)\ **Post date:** [May 7, 2021, 7:33am UTC](https://community.rapyd.net/t/is-the-documentation-for-webhook-signatures-correct/239/1 "2021-05-07T07:33:20Z")
Looking at [Webhooks](https://docs.rapyd.net/build-with-rapyd/reference/webhooks#webhook-signatures) it says that the signature consist of **_signature_ = BASE64 ( HASH ( _url\_path_ + _salt_ + …** But when looking at the Magento implementation [Rapyd-Magento2/Webhook.php at 13401f68af14d4543217a92cb07e097fd0bfbfae · RapydPayments/Rapyd-Magento2 · GitHub](https://github.com/RapydPayments/Rapyd-Magento2/blob/13401f68af14d4543217a92cb07e097fd0bfbfae/Model/Api/Webhook.php#L91) it consist of: $sig\_string = **$http\_method**. $path . $salt . Is it meant to be with or without http\_method? Edit: or maybe the Magento implementation is wrong as it also expects the access key to be in the header _**$access\_key = $headers[‘accessKey’];**_ and the documentation isn’t mentioned about this, as the webhook call, I have received didn’t have any access key in the header either. ---
**Author:** ![onesoft](https://sea2.discourse-cdn.com/flex016/user_avatar/community.rapyd.net/onesoft/32/832_2.png) [@onesoft](https://community.rapyd.net/u/onesoft)\ **Post date:** [May 7, 2021, 7:57am UTC](https://community.rapyd.net/t/is-the-documentation-for-webhook-signatures-correct/239/2 "2021-05-07T07:57:56Z")
Ok - found the answer: the **http\_method** isn’t part of the signature in a webhook request