# A Developer's Guide to HMAC Validation for Adyen Webhooks

DevFeed: [A Developer's Guide to HMAC Validation for Adyen Webhooks](<https://devfeed.tech/articles/a-developer-s-guide-to-hmac-validation-for-adyen-webhooks-26254.md>)

Original publisher: [Read original article](<https://medium.com/adyen/a-developers-guide-to-hmac-validation-for-adyen-webhooks-581dffb454a8?source=rss----64941d9fbc09---4>)

Author: Adyen

Published: 2025-06-16T09:38:43Z

Content type: tutorial

Language: en

Sources: [Adyen Tech](<https://devfeed.tech/sources/adyen-tech.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [integrity](<https://devfeed.tech/topics/integrity.md>), [payload](<https://devfeed.tech/topics/payload.md>), [implementation](<https://devfeed.tech/topics/implementation.md>), [JSON](<https://devfeed.tech/topics/json.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [adyen](<https://devfeed.tech/tags/adyen.md>), [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [developer](<https://devfeed.tech/tags/developer.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [guide](<https://devfeed.tech/tags/guide.md>), [hmac](<https://devfeed.tech/tags/hmac.md>), [http](<https://devfeed.tech/tags/http.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [integration](<https://devfeed.tech/tags/integration.md>), [json](<https://devfeed.tech/tags/json.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [payload](<https://devfeed.tech/tags/payload.md>), [payments](<https://devfeed.tech/tags/payments.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [validation](<https://devfeed.tech/tags/validation.md>), [webhooks](<https://devfeed.tech/tags/webhooks.md>)

## AI overview

This guide explains how Adyen uses HMAC signatures to protect the authenticity and integrity of webhook payloads. It distinguishes payment webhooks, which include the signature in the JSON payload, from other webhooks, which provide it in an HTTP header, and discusses custom validation and Adyen's open-source libraries.

## Source excerpt

By Beppe Catanese, Developer Relations, AdyenImage by authorIntroduction When it comes to payments, security isn't optional -- it's essential. If you're integrating with Adyen, ensuring the incoming webhooks' authenticity and integrity is very important. That's where Hash-based Message Authentication Code (HMAC) plays a critical role in securing your Adyen integration. Image by author Implementing, testing, and troubleshooting HMAC validation can be challenging. This guide explains how HMAC validation works, highlights the challenges, and provides tools and best practices for secure and reliable implementation. HMAC at Adyen All Adyen webhooks use HMAC to ensure the integrity and authenticity of the payloads delivered to your integrations. The HMAC key should be enabled when setting up a new webhook (either in the Customer Area Webhook page or using the Management API). Adyen will use the HMAC key to sign the payload by creating an HMAC signature. You must validate the HMAC signature, delivered with the webhook, using the same HMAC key. Adyen webhooks fall into two main categories, each with its approach to HMAC implementation. Let's explore the two scenarios. 1. Payments Webhooks For payments-related webhooks, the calculation of the signature involves using a subset of fields, and it's embedded directly within the JSON payload under the `additionalData` object: { "live":"false", "notificationItems":[ { "NotificationRequestItem":{ "additionalData":{ "hmacSignature":"+JWKfq4ynALK+FFzGgHnp1jSMQJMBJeb87dlph24sXw=" }, ... } } ] }2. Other Webhooks (Adyen for Platforms, Management) For non-payment webhooks, the signature is calculated using the entire JSON payload. Instead of being included in the payload itself, the signature is provided in the HTTP Header `hmacSignature`: content-length: 1614 content-type: application/json hmacsignature: SMQZFOq3oIdugmf97u9TB+5256jjXgUX3MRjK+RlGNQ=Implementing HMAC Validation Developers have two options for implementing HMAC validation: