Class WebhookSignature

Namespace

Mailtrap.Webhooks

Assembly

Mailtrap.Abstractions.dll

Helpers for verifying inbound Mailtrap webhook signatures.

public static class WebhookSignature

Inheritance

object

WebhookSignature

Remarks

Mailtrap signs every outbound webhook by computing HMAC-SHA256(signing_secret, raw_request_body) and sending the lowercase hex digest in the Mailtrap-Signature HTTP header. To authenticate a webhook on the receiver side, compute the same digest using the signing_secret returned when the webhook was created and compare it to the value of the header in constant time.

The comparison is performed in constant time to avoid timing side-channels.

Verify(string, string, string) never throws on inputs that could plausibly arrive over the wire (null / empty strings, wrong-length signatures, non-hex characters, missing secret) — it simply returns false. This makes it safe to call directly from a request handler without wrapping in try/catch.

See the Mailtrap documentation — Verifying the signature.

Fields

SignatureHexLength

Hex-encoded HMAC-SHA256 signature length (SHA-256 produces 32 bytes / 64 hex chars).

public const int SignatureHexLength = 64

Field Value

int

Methods

Verify(string, string, string)

Verifies the HMAC-SHA256 signature of a Mailtrap webhook payload.

public static bool Verify(string payload, string signature, string signingSecret)

Parameters

payload string

The raw request body, exactly as received. Do not parse and re-serialize the JSON — re-encoding may reorder keys or alter whitespace and invalidate the signature. In ASP.NET Core, call HttpRequest.EnableBuffering() and read the body via new StreamReader(Request.Body).ReadToEndAsync(), or bind directly to a byte[] / Stream on the webhook endpoint so the body is preserved verbatim.

signature string

The value of the Mailtrap-Signature HTTP header (lowercase hex string).

signingSecret string

The webhook's signing_secret, returned by the Webhooks API on webhook creation.

Returns

bool

true if signature is valid for the given payload and signingSecret; false otherwise (including any null / empty input, wrong-length or non-hex signatures).