> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aient.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook signing

> Verify Aient webhook signatures using the raw request body and endpoint secret, reject stale or malformed signatures, and deduplicate events before processing.

# Webhook signing

Verify webhook signatures before parsing the event into business logic. Keep the raw request body bytes because signature verification depends on the exact payload that Aient sent.

## Consumer checklist

* Read the raw request body before JSON parsing.
* Verify the Aient signature header with the endpoint secret configured in Aient.
* Reject missing, malformed, or stale signatures.
* Deduplicate by the CloudEvents (`source`, `id`) tuple after verification.
* Return 2xx only after the event is durably accepted.

If verification fails, return a non-2xx response and do not process the event.