{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/voice-2.0/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"product":"Voice v2 (preview)","type":"markdown"},"seo":{"title":"Webhook request signing | Voice API v2 | Sinch","siteUrl":"https://developers.sinch.com","llmstxt":{"title":"Sinch Developer Documentation","description":"LLMs.txt containing a map of all the documentation files for Sinch.","sections":[{"title":"Numbers API","description":"The Numbers API enables you to search for, view, and activate numbers. It's considered a precursor to other APIs in the Sinch product family. The numbers API can be used in tandem with any of our APIs that perform messaging or calling.","includeFiles":["docs/numbers/**/*.md","docs/numbers/**/*.yaml"],"excludeFiles":["docs/numbers/index.md"]},{"title":"Conversation API","description":"Send and receive messages globally on many popular channels with ease and confidence when using Sinch's Conversation API. Conversation API is the preferred API for sending mobile messages on SMS and other social channels with Sinch. It is a simple API with unified error messages, consistent request payloads, and common webhook payloads that are channel-agnostic.","includeFiles":["docs/conversation/**/*.md","docs/conversation/**/*.yaml"],"excludeFiles":["docs/conversation/index.md"]},{"title":"Voice API","description":"The Voice API works as a big telephony switch. The Voice API handles incoming phone calls (also known as incoming call “legs”), sets up outgoing phone calls (or outgoing call “legs”), and bridges the two. The incoming call leg may come in over a data connection (from a smartphone or web application using the Sinch SDKs) or through a local phone number (from the PSTN network). Similarly, the outgoing call leg can be over data (to another smartphone or web application using the Sinch SDKs) or the PSTN network.","includeFiles":["docs/voice/**/*.md","docs/voice/**/*.yaml"],"excludeFiles":["docs/voice/index.md"]},{"title":"Voice API v2","description":"The Voice API works as a big telephony switch. The Voice API handles incoming phone calls (also known as incoming call “legs”), sets up outgoing phone calls (or outgoing call “legs”), and bridges the two. The incoming call leg may come in over a data connection (from a smartphone or web application using the Sinch SDKs) or through a local phone number (from the PSTN network). Similarly, the outgoing call leg can be over data (to another smartphone or web application using the Sinch SDKs) or the PSTN network.","includeFiles":["docs/voice-2.0/**/*.md","docs/voice-2.0/**/*.yaml"],"excludeFiles":["docs/voice-2.0/index.md"]},{"title":"Verification API","description":"The Verification API is a platform for phone number verification. It consists of the API and different software development kits (the Sinch SDKs) that you integrate with your smartphone or web application and cloud based back-end services. Together they enable SMS, Flashcall, Phone Call and Data verification in your application.","includeFiles":["docs/verification/**/*.md","docs/verification/**/*.yaml"],"excludeFiles":["docs/verification/index.md"]},{"title":"Provisioning API","description":"Provisioning API allows you to programmatically set up your senders, accounts and templates on your favorite messaging platforms on the Conversation API. For now, you can create your first WhatsApp channel through Meta's Embedded sign up, you can configure your first SMS App and configure your webhooks. As development continues, we will be adding the most commonly used channels.","includeFiles":["docs/provisioning-api/**/*.md","docs/provisioning-api/**/*.json"],"excludeFiles":["docs/provisioning-api/index.md"]},{"title":"Elastic SIP Trunking API","description":"With Elastic SIP Trunking you can create and manage your SIP trunks and phone numbers programmatically.","includeFiles":["docs/est/**/*.md","docs/est/**/*.yaml"],"excludeFiles":["docs/est/index.md"]},{"title":"Fax API","description":"Send and receive HIPAA compliant faxes on our modern fax platform using our developer-friendly API.","includeFiles":["docs/fax/**/*.md","docs/fax/**/*.yaml"],"excludeFiles":["docs/fax/index.md"]},{"title":"In-app Voice and Video SDK","description":"The In-app Voice and Video SDK enables you to add voice and video calling capabilities directly into your mobile or web application using the Sinch SDKs.","includeFiles":["docs/in-app-calling/**/*.md"],"excludeFiles":["docs/in-app-calling/index.md"]},{"title":"Number Lookup API","description":"The Number Lookup API is designed to provide in-depth information about phone numbers, helping enterprises enhance their communication strategies and prevent fraud. By identifying the type of phone line (for example, mobile, landline, VoIP) and the associated carrier, the API allows businesses to optimize routing, reduce unnecessary costs, and improve customer engagement.","includeFiles":["docs/number-lookup-api-v2/**/*.md","docs/number-lookup-api-v2/**/*.yaml"],"excludeFiles":["docs/number-lookup-api-v2/index.md"]},{"title":"Functions","description":"Serverless compute for voice and messaging. Deploy your code and Sinch routes live calls and messages to it — no infrastructure to run.","includeFiles":["docs/functions/functions/**/*.md","docs/functions/concepts/**/*.md","docs/functions/reference/**/*.md"],"excludeFiles":["docs/functions/functions/index.md"]},{"title":"CLI","description":"One command line for every Sinch API and the full Functions lifecycle — scaffold, run locally, deploy, and manage.","includeFiles":["docs/functions/cli/**/*.md"],"excludeFiles":["docs/functions/cli/index.md"]}]},"description":"How to sign Webhook requests with the Voice API."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"webhook-request-signing","__idx":0},"children":["Webhook Request Signing"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Sinch Platform can initiate webhook requests to an URL you define (",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Webhook URL"]},") on events like call.incoming, call.answered, call.hangup and more."," ","All Webhook requests are signed using your Service access key and secret pair found on your ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://dashboard.sinch.com/voice-v2/services"},"children":["dashboard"]},". The signature is included in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization"]}," header of the request."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","header":{"controls":{"copy":{}}},"source":"    authorization = \"service\" + \" \" + serviceKey + \":\" + Signature\n\n    Signature = Base64 ( HMAC-SHA256 ( Base64-Decode( serviceSecret ), UTF8 ( StringToSign ) ) );\n\n    StringToSign = HTTP-Verb + \"\\n\" +\n        Content-MD5 + \"\\n\" +\n        content-type + \"\\n\" +\n        CanonicalizedHeaders + \"\\n\" +\n        CanonicalizedResource;\n\n    Content-MD5 = Base64 ( MD5 ( [BODY] ) )\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Pseudocode Component"},"children":["Pseudocode Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CanonicalizedHeaders"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The only required header is ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#timestamp"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["x-timestamp"]}]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CanonicalizedResource"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The path to the API resource. For example, /v2/projects/{projectId}/calls."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Service ID/Service Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Id/Key for your Programmable Voice Service can be found on your dashboard, under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configure call behaviour"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Service Secret"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The secret for your Programmable Voice Service can also be found on your dashboard."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"timestamp","__idx":1},"children":["Timestamp"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The client must send a custom header ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["x-timestamp"]}," (time) with each request that's validated by the server. This custom header is used to determine that the request is not too old. The timestamp is also part of the signature. The timestamp must be formatted to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://en.wikipedia.org/wiki/ISO_8601"},"children":["ISO 8061"]}," specifications."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important!"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The timestamp must be in the Coordinated Universal Time (UTC) timezone."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","data-title":"Example of timestamp header","header":{"title":"Example of timestamp header","controls":{"copy":{}}},"source":"x-timestamp: 2026-06-02T15:39:31.2729234Z\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"webhook-signature-validation-example","__idx":2},"children":["Webhook Signature Validation Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In this example, assume that the ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Webhook URL"]}," is configured as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["\"https://yourdomain.com/sinch/webhook\""]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"shell","header":{"controls":{"copy":{}}},"source":"    serviceKey = 669E367E-6BBA-48AB-AF15-266871C28135\n    serviceSecret = BeIukql3pTKJ8RGL5zo0DA==\n\n    Headers: \n    {\n        host: 'yourdomain.com',\n        'content-length': '724',\n        authorization: 'service XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',\n        baggage: 'SessionId+=+01KTSPWJP2YPH9KSAKC2SRP7W8',\n        'ce-id': '55f0102b-739a-4151-8caf-9b3aaf249859',\n        'ce-source': 'projects/727ce3a0-b9ac-4b65-8a53-29e4e0d5c270/services/b7430a33-38c8-4fba-9fb7-c66eae501d11',\n        'ce-specversion': '1.0',\n        'ce-time': '2026-06-10T21:27:04.0783345+00:00',\n        'ce-type': 'com.sinch.voice.webhook.v2',\n        'content-type': 'application/json; charset=utf-8',\n        traceparent: '00-5a8c4644667b4b60784f22c0544d335d-701eb65af934e502-01',\n        'x-forwarded-for': '15.228.118.128',\n        'x-forwarded-host': 'yourdomain.com',\n        'x-forwarded-proto': 'https',\n        'x-timestamp': '2026-06-10T21:27:04.1466768Z',\n        'accept-encoding': 'gzip'\n    }\n\n    Body:\n    {\n    event: 'call.webhook.call.answered',\n    call: {\n        callId: '01KTSPWYAFT6MZ3TM7H43K82VQ',\n        serviceId: 'b7430a33-38c8-4fba-9fb7-c66eae501d11',\n        projectId: '727ce3a0-b9ac-4b65-8a53-29e4e0d5c270',\n        sessionId: '01KTSPWHMJGTPV36FSBY7C6Z44',\n        to: {\n            type: 'STREAM', stream: [Object] \n            },\n        direction: 'OUTBOUND',\n        callResult: 'IN_PROGRESS',\n        callType: 'STREAM',\n        originationType: 'SERVER',\n        startTime: '2026-06-10T21:27:02.6695935',\n        answerTime: '2026-06-10T21:27:03.865752',\n        updateTime: '2026-06-10T21:27:03.865752',\n        callRate: { \n            currencyCode: 'EUR',\n            amount: 0.0028\n            },\n        callResourceUrl: '/v2/projects/727ce3a0-b9ac-4b65-8a53-29e4e0d5c270/calls/01KTSPWYAFT6MZ3TM7H43K82VQ'\n        }\n    }\n\n\n    Content-MD5 = Base64 ( MD5 ( [BODY] ) )\n        REWF+X220L4/Gw1spXOU7g==\n\n    StringToSign\n        POST\n        REWF+X220L4/Gw1spXOU7g==\n        application/json\n        x-timestamp:2014-09-24T10:59:41Z\n        /sinch/webhook\n\n    Signature = Base64 ( HMAC-SHA256 ( Base64-Decode( serviceSecret ), UTF8 ( StringToSign ) ) )\n        Tg6fMyo8mj9pYfWQ9ssbx3Tc1BNC87IEygAfLbJqZb4=\n\n    HTTP Authorization Header\n        authorization: service 669E367E-6BBA-48AB-AF15-266871C28135:Tg6fMyo8mj9pYfWQ9ssbx3Tc1BNC87IEygAfLbJqZb4=\n","lang":"shell"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Important!"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The service Secret value must be base64-decoded from before it's used for signing/validation."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note:"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["HTTP headers are case-insensitive, so you don't need to worry about casing."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"webhook-request-validation","__idx":3},"children":["Webhook Request Validation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your development platform that receives the Webhooks can verify that the request originated from Sinch by calculating the signature as described above and compare the result with the value contained in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["service"]}," HTTP header."]}]},"headings":[{"value":"Webhook Request Signing","id":"webhook-request-signing","depth":1},{"value":"Timestamp","id":"timestamp","depth":2},{"value":"Webhook Signature Validation Example","id":"webhook-signature-validation-example","depth":2},{"value":"Webhook Request Validation","id":"webhook-request-validation","depth":2}],"frontmatter":{"seo":{"title":"Webhook request signing | Voice API v2 | Sinch","description":"How to sign Webhook requests with the Voice API."}},"lastModified":"2026-09-01T20:22:18.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/voice-2.0/api-reference/webhook-signature","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}