Skip to main content
client.webhooks verifies the HMAC signature on an inbound webhook and returns a typed WebhookEvent. See Webhooks for the conceptual model and signing algorithm. No network call is made — verification is local crypto against the whsec_... secret you saved in the developer portal.

Verifying a delivery

Pass the raw request body bytes, not the parsed JSON — frameworks may reorder keys during re-serialization and the signature will no longer verify. Returns a WebhookEvent. Raises WebhookSignatureError on any verification failure.

FastAPI example

Flask example

Async

AsyncSpineClient.webhooks.construct_event(...) has the same signature. Verification is CPU-only, so the async variant exists for API-parity with the rest of the client rather than for performance.

WebhookEvent

Notes

  • Clock skew matters. If your server drifts more than 5 minutes from Spine’s clock, deliveries will be rejected as stale. Run NTP.
  • Rotation invalidates the previous secret immediately. Update your env var before rotating if you care about strict uptime.
  • The SDK accepts multiple v1= values in one header, so a future dual-signing rotation strategy will be forward-compatible.