title: WooCommerce Webhooks Auth (secret & signature) - how to use
body: <p>I'm trying to create an integration between <a href="https://docs.woocommerce.com/document/webhooks/" rel="noreferrer"><strong>WooCommerce Webhook API</strong></a> and my Node.js backend. However, I can't really figure out how I'm suppose to use the secret to authenticate the request.</p>
  
  <p><code>secret:</code> an optional secret key that is used to generate a <code>HMAC-SHA256</code> hash of the request body so the receiver can verify authenticity of the webhook.</p>
  
  <p><code>X-WC-Webhook-Signature:</code> a Base64 encoded HMAC-SHA256 hash of the payload.</p>
  
  <p><strong>WooCommerce backend:</strong>
  (Hemmelighed = "Secret")
  <a href="https://i.stack.imgur.com/c9vSX.png" rel="noreferrer"><img src="https://i.stack.imgur.com/c9vSX.png" alt="enter image description here"></a></p>
  
  <p><strong>Nodejs backend:</strong></p>
  
  <pre><code>var bodyParser = require('body-parser');
  app.use(bodyParser.json());
  app.use(bodyParser.urlencoded({ extended: false }));
  
  router.post('/', function (req, res) {
      var secret = 'ciPV6gjCbu&amp;efdgbhfgj&amp;¤"#&amp;¤GDA';
      var signature = req.header("x-wc-webhook-signature");
      var hash = CryptoJS.HmacSHA256(req.body, secret).toString(CryptoJS.enc.Base64);
  
      if(hash === signature){
          res.send('match');
      } else {
          res.send("no match");
      }
  
  });
  </code></pre>
  
  <p>Source: <a href="https://github.com/woocommerce/woocommerce/pull/5941" rel="noreferrer">https://github.com/woocommerce/woocommerce/pull/5941</a></p>
  
  <p><a href="https://woocommerce.github.io/woocommerce-rest-api-docs/#webhooks" rel="noreferrer">WooCommerce REST API source</a></p>
  
  <p>The hash and the signature doesn't match. What is wrong?</p>
  
  <p><strong>Update:</strong>
  <code>console.log</code> returns these values:</p>
  
  <p><code>hash</code>: pU9kXddJPY9MG9i2ZFLNTu3TXZA++85pnwfPqMr0dg0= </p>
  
  <p><code>signature</code>: PjKImjr9Hk9MmIdUMc+pEmCqBoRXA5f3Ac6tnji7exU= </p>
  
  <p><code>hash (without .toString(CryptoJS.enc.Base64))</code>: a54f645dd7493d8f4c1bd8b66452cd4eedd35d903efbce699f07cfa8caf4760d</p>