## How it works

Verify the HMAC-SHA512 signature before trusting a webhook in your Rust service. Preserve the raw request bytes until verification completes.

## Implementation

Decode the hexadecimal signature, compute the expected digest with the shop signing secret and compare safely. Parse JSON only after success, deduplicate event_id and persist before acknowledging. Isolate test events from real fulfilment, compare amount and currency and process each order once. API keys and webhook signing secrets are separate credentials.

## In this area

- Verify a webhook
- Event content

## Related guides

- [Rust SDK](/docs/sdks/rust/getting-started/)
- [Webhook events](/docs/payment-api/webhooks/)