> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unseen.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Server SDK — Webhook signatures

> Verify X-Unseen-Signature with unseen.webhooks.verify and sign test payloads with unseen.webhooks.sign.

With `payments.verify` wired, automate fulfillment using **HTTP callbacks**. This page covers the cryptography—**before** treating any JSON blob as authoritative.

Unseen delivers signed webhook POST bodies. Confirm authenticity before parsing JSON:

```ts theme={null}
const ok = unseen.webhooks.verify(rawBodyString, signatureHeader, process.env.UNSEEN_WEBHOOK_SECRET!);

if (!ok) {
  return new Response("Invalid signature", { status: 401 });
}

const event = JSON.parse(rawBodyString);
```

* **`rawBodyString`** — the raw request payload **exactly as received**. With Express, configure a [`express.raw`-style](https://expressjs.com/en/api.html) middleware **or** `bodyParser.raw` for this route only so `req.body` is a `Buffer` you convert to UTF-8 string before verify. Do **not** verify against `JSON.stringify(req.body)` after `express.json()` already mutated the bytes.
* **`signatureHeader`** — value of `X-Unseen-Signature` (hex HMAC-SHA256 of the raw body with your webhook secret).
* **`secret`** — signing secret from the Unseen dashboard.

## Testing

`unseen.webhooks.sign(payload, secret)` reproduces the hex digest for fixtures and integration tests.

**Next:** [Errors & types](/sdk/server/errors-types)