Webhook signature verification in PHP

Moralis General
#1

I write down code like below but didn’t work for me.

$response = file_get_contents('php://input');
$provided_signature = $request->headers->get("x-signature");
$generated_signature = hash_hmac('sha256', $response, $secret);
if ($provided_signature===$generated_signature) {
        echo "ok";
}
echo "Not ok";
#2

hello, you have to use the hash specific to eth, not sha256, you can test here the hash:

https://emn178.github.io/online-tools/keccak_256.html
1 Like
#3

Thank you for your response
I checked and it’s working.
I think the keccak-256 algorithm is commonly referred to as SHA3-256.

#4

Hi, happy to hear it is working now.

SHA-256 stems from the SHA-2 standard with a 256 bit key, while Keccak-256 is a function within Solidity and stems from the SHA-3 family. Keccak-256 is stronger than SHA-256 . SHA-256 generates a SHA-256 hash, while Keccak-256 generates a Keccak-256 hash.

1 Like