---
title: "Verify Attio Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Attio webhook signature verifier. Validate the Attio-Signature header against your webhook secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Attio Webhook Signatures — Free Online Tool"
description: "Free online Attio webhook signature verifier. Validate the Attio-Signature header against your webhook secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Attio Webhook Signatures**
Attio signs each webhook with HMAC-SHA256 over the request body using the webhook's secret, and sends the hex digest in the `Attio-Signature` header. Paste the raw body, the secret from your developer settings and the signature below.
**Raw request body (payload)**
**Webhook secret**
**Computed signature**
**Signature to verify **(Attio-Signature)
**Paste the Attio-Signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-attio-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-attio-webhook-signature/hmac-verification/).
## **How Attio signs webhooks**
1. Get the webhook's secret from the Attio developer settings page (also returned by the API when the webhook is created).
2. Compute HMAC-SHA256 of the **raw** request body using the secret as the key.
3. Hex-encode the digest and compare it to `Attio-Signature` with a constant-time comparison.
4. Prefer signature verification over IP allowlisting — it keeps working when Attio adds new egress IPs.
**References & official docs:**
- [Attio — Configuring webhooks](https://docs.attio.com/rest-api/guides/webhooks)
## **Verify Attio signatures in code**
**Node.js**
```
const crypto = require('crypto');
function isValidAttioWebhook(rawBody, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(signature));
}
const ok = isValidAttioWebhook(
rawBody,
req.headers['attio-signature'],
process.env.ATTIO_WEBHOOK_SECRET);
```
**Python**
```
import hashlib, hmac
def is_valid_attio_webhook(raw_body: bytes, signature: str,
secret: str) -> bool:
expected = hmac.new(secret.encode(), raw_body,
hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, signature)
```
## **Frequently asked questions**
**Where is the Attio webhook secret?**
On the webhook's page in Attio developer settings, and in the API response when the webhook is created. Each webhook has its own secret.
**What encoding does the signature use?**
Lowercase hex of the HMAC-SHA256 digest — no prefix, no base64. If your computed value looks right but longer or shorter, check you are hex-encoding, not base64-encoding.
**Does Attio batch events?**
Yes — a single delivery carries an `events` array, each entry with its own `event_type` and record identifiers, under one `webhook_id`. Verify the delivery once, then iterate the array.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-attio-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-attio-webhook-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-attio-webhook-signature/verify-shopify-webhook-signature/) [ Slack](https://webhookrelay.com/verify-attio-webhook-signature/verify-slack-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-attio-webhook-signature/verify-twilio-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-attio-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-attio-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-attio-webhook-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-attio-webhook-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-attio-webhook-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-attio-webhook-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-attio-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-attio-webhook-signature/verify-klarna-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-attio-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-attio-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-attio-webhook-signature/webhook-bin/)
Receiving Attio webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-attio-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-attio-webhook-signature/features/transform-webhooks/) before delivery.