HMAC checks the request body against the source secret
A source-specific webhook route identifies the configuration meant to handle a request, but the route by itself does not show that the body was signed with that source's secret. HMAC lets the receiver calculate a digest from the exact raw request body and the secret assigned to the source. If the supplied signature matches, that body validates under the configured secret. If it does not match, the request fails verification.
Deal Flow applies this check to inbound webhook sources. Each source has its own endpoint and unique HMAC signing secret, creating a separate verification context for every declared source.
Technical details verified August 30, 2026 against the Deal Flow webhook reference and its published HMAC request-signing contract.
Think of HMAC as a shared-secret fingerprint
HMAC combines a message with a secret to produce a cryptographic digest. For an inbound webhook, the message is the exact raw request body and the secret belongs to the configured source. The sender calculates the digest before sending the request. The receiver calculates it again from the bytes it receives and the secret assigned to that source.
A matching digest shows that the supplied signature was generated for the exact body using that source's secret. The source label or route by itself does not establish that relationship.
The secret drives the check. Naming a source selects its configuration. A valid HMAC digest means the supplied signature matches the exact body under the secret assigned to that source.
Why an unsigned inbound endpoint falls short
A source-specific endpoint can route an incoming request to the intended configuration. The route alone does not provide the documented cryptographic check that ties the request body to the source's secret.
HMAC adds that check without changing the deal data itself. The request body remains the message being delivered; the signature is a separate value calculated from that exact body and the source's secret.
Give every inbound source its own secret
The endpoint identifies the source
Each inbound webhook source gets its own endpoint. A request arriving on that route declares which configured source should receive it.
The secret powers the signature check
Each source also gets a unique HMAC signing secret. Verification calculates the expected digest for the request body with the secret assigned to that source.
This per-source model pairs the routing identity with its signing secret. The sender signs with its source's secret, and the receiving endpoint checks the signature against that same source configuration.
Use the published signing contract for implementation
The current webhook reference specifies HMAC-SHA256 over the exact raw request body using the source's signing secret. Exact bytes matter: a whitespace difference between the body used for the digest and the body sent causes a mismatch.
This page explains the security check rather than repeating the request format or code examples. Use the HMAC signing reference for those implementation details.
Signature algorithm, body handling, and response behavior checked August 30, 2026 against the published webhook reference.
Reject missing or invalid signatures with HTTP 403
Deal Flow rejects an inbound webhook request with HTTP 403 when its signature is missing or invalid. That is the complete verification-failure behavior covered here; use the webhook reference for the request contract and troubleshooting details.
Keep security, contract, and workflow guidance separate
- Use the webhook reference for the current endpoint and field-level contract.
- Use the Mautic webhook integration guide for workflow direction and setup sequence.
This guide covers the security reasoning and signing check. The linked pages remain the implementation references for what to send and how the webhook fits into a wider workflow.
Add signed deal intake to Mautic
Deal Flow gives each inbound source its own endpoint and HMAC secret for signed request checks.
See Deal Flow Pricing Try free for 7 daysFrequently asked questions
What does HMAC signing verify?
It checks whether the supplied signature matches a digest calculated from the exact raw request body and the source's secret. A match validates that body-and-signature pair under the configured secret.
Why must the sender sign the exact raw request body?
The documented check calculates HMAC-SHA256 from the body bytes sent. Changing whitespace or any other byte after calculating the digest causes a mismatch.
What happens when the signature is missing or invalid?
Deal Flow rejects the inbound webhook request with HTTP 403. That is the failure behavior documented for requests without a valid signature.
Does each inbound source have its own HMAC secret?
Yes. Each inbound webhook source has its own endpoint and unique HMAC signing secret, so verification uses the secret assigned to that source.