Verify BOS webhook signatures
Use each webhook signing secret to verify X-BOS-Signature before trusting inbound event payloads in n8n or your app.
Why this matters
When BOS sends an outbound event, the receiving app should confirm that the event really came from BOS and was not changed in between.
Headers BOS sends
- X-BOS-Event contains the event name.
- X-BOS-Delivery-ID is the unique delivery attempt ID.
- X-BOS-Timestamp shows when BOS sent the event.
- X-BOS-Signature contains sha256= followed by an HMAC SHA-256 signature.
How to verify
Copy the webhook signing secret when the webhook is created or regenerated. In your app, calculate HMAC SHA-256 using the raw request body and that secret. Compare it with X-BOS-Signature.