> ## Documentation Index
> Fetch the complete documentation index at: https://docs.augustus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> When sending webhooks to your endpoints, Augustus will sign the request with a secret key. You can view and manage your secret key in the Augustus Dashboard.

## Overview

All requests sent to your endpoints will include the `X-Ivy-Signature` header. Verify this value to ensure the request is coming from Augustus and not from a third party.

To validate incoming requests:

* Obtain the `Webhook Signing Secret` from the Augustus Dashboard
* Check the `X-Ivy-Signature` Header against a newly calculated Signature for every incoming request
* Calculate the signature using the request body and the `Webhook Signing Secret` with HMAC & SHA-256 Hash

<Warning>
  Only if the signature is valid, continue processing the request!
</Warning>

If the signature is invalid, return a 4xx status code and do not process the request.

### Code Examples

<CodeGroup>
  ```typescript TypeScript theme={null}
  const { createHmac } = require('crypto')
  const config = require('../config')


  // This middleware validates the request body against the X-Ivy-Signature header.
  // If the signature is invalid, an error is thrown.
  // If the signature is valid, the next middleware is called.
  function validateRequest(req, res, next) {
    const secret = config.IVY_WEBHOOK_SIGNING_SECRET
    const data = req.body
    const expectedSignature = sign(data, secret)

    const signature = req.get('X-Ivy-Signature')

    if (signature !== expectedSignature) throw new Error('Invalid signature!')

    next()
  }

  // Parameter "data" is the request/response body.
  // The response is the X-Ivy-Signature.
  function sign(data, secret) {
    const hmac = createHmac('sha256', secret)
    hmac.update(JSON.stringify(data))
    return hmac.digest('hex')
  }
  ```

  ```python Python theme={null}
  import hmac
  import hashlib
  import json
  import os

  def sign(data):
      return hmac.new(
          os.environ['IVY_WEBHOOK_SIGNING_SECRET'].encode('utf-8'),
          json.dumps(data).encode('utf-8'),
          hashlib.sha256
      ).hexdigest()
  ```

  ```php PHP theme={null}
  <?php
  // Assuming you have a similar config file in PHP
  require_once('../config.php');

  /*
    This function validates the request body against the X-Ivy-Signature header.
    If the signature is invalid, false is returned.
  */
  function isValidRequest(RequestInterface $request)
  {
      $hash = hash_hmac(
          'sha256',
          $request->getContent(),
          $this->config->getWebhookSecret()
      );

      if ($request->getHeaders('x-ivy-signature')->getFieldValue() === $hash) {
          return true;
      }

      return false;
  }
  ```
</CodeGroup>