HMAC signature
An HMAC signature is a message authentication code computed from a shared secret and a cryptographic hash function. It lets a recipient verify that a message came from a party holding the secret and that the signed content was not changed in transit.
How an HMAC signature works
The sender and receiver hold the same secret. Before sending a message, the sender runs the agreed HMAC algorithm over defined message bytes and attaches the result as a signature. The receiver performs the same calculation with its copy of the secret. If the results match, the receiver has evidence that the content is authentic and intact.
Both sides must sign exactly the same bytes. Parsing a JSON body and serializing it again can change spacing or key order, producing a different result even when the data looks equivalent. Webhook handlers therefore commonly verify the raw request body before transforming it.
The comparison should avoid leaking information through timing differences, and secrets should be stored and rotated as credentials. If the signing scheme includes a timestamp or unique delivery value, the receiver can also reject old or repeated messages according to the sender’s documented procedure.
An HMAC signature does not encrypt the message. Anyone able to observe an unencrypted request could still read its body. Transport encryption protects confidentiality in transit, while HMAC protects authenticity and integrity. The receiver still needs authorization checks and careful input validation after signature verification.
Why it matters for AI phone calls
Call platforms often send webhooks containing call status, routing data, transcripts, summaries, or tool results. Acting on a forged request could update a customer record, trigger follow-up, or disclose information to the wrong workflow. Signature verification establishes a trust boundary before that business logic runs.
Verification failures should be logged without recording the secret or unnecessary sensitive content. Teams should also plan secret rotation so the endpoint can move to a new credential without silently dropping valid events.
In practice on ThunderPhone
ThunderPhone signs webhook requests with HMAC-SHA256. Each webhook endpoint has its own secret, allowing receivers to verify requests per endpoint rather than sharing one credential across every subscription.