Webhook Security

Every webhook delivery includes a signature that you should verify to ensure the request originated from RxScale and was not tampered with.

Signature Verification

Each webhook request includes a signature header. Verify it by computing an HMAC-SHA256 hash of the request body using the webhook_secret returned when you registered the subscription.

Example (Python)

import hmac
import hashlib

def verify_webhook(payload_body: bytes, signature: str, webhook_secret: str) -> bool:
    expected = hmac.new(
        webhook_secret.encode(),
        payload_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Example (Node.js)

const crypto = require('crypto');

function verifyWebhook(payloadBody, signature, webhookSecret) {
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(payloadBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

Best Practices

Always verify signatures

Never process webhook payloads without verifying the signature first. This protects against spoofed requests.

Use constant-time comparison

Always use hmac.compare_digest (Python) or crypto.timingSafeEqual (Node.js) to prevent timing attacks.

Respond quickly

You must return a 2xx response within the delivery timeout of 30 seconds. A slower response (or no response) counts as a failed delivery and is retried with exponential backoff — see the Retry Policy.We nonetheless recommend acknowledging much faster than that — a good target is under 5 seconds — by returning 2xx as soon as you have stored the payload and doing any heavy processing asynchronously afterwards. The 5 seconds is a recommendation, not a requirement; only the 30-second timeout is enforced.

Handle duplicates

Webhook deliveries may be retried. Use the event_type + timestamp + data.uid to deduplicate events.

Getting Started

External Pharmacy API

Management API

Scheduling API

Public API

Patient API

Anamnesis API

Webhooks

Guides

Security

Webhook Security

Signature Verification

Example (Python)

Example (Node.js)

Best Practices

​Webhook Security

​Signature Verification

​Example (Python)

​Example (Node.js)

​Best Practices

Webhook Security

Signature Verification

Example (Python)

Example (Node.js)

Best Practices