Source · Generic HMAC · Verified November 1, 2026
Generic HMAC
Short answer: Generic sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature.
Hooks verifies Generic HMAC deliveries with hmac-sha256 over <timestamp>.<deliveryid>.<body> and normalizes them into the unified event format.
Set up the webhook in Generic HMAC
- Open the Generic HMAC webhook settings in the provider console.
- Point the webhook at your Hooks endpoint URL (
https://api.hooks.events/in/<endpoint-id>). - Paste the same secret into the endpoint so Hooks can check x-signature.
Signature verification
| Header | x-signature |
|---|---|
| Algorithm | HMAC-SHA256 over <timestamp>.<deliveryId>.<body> |
| Replay window | 5 minutes |
| Delivery id | Body `id` |
- HMAC-SHA256 over
<timestamp>.<deliveryId>.<body>
Events Hooks normalizes
| event.type | subject | What it means |
|---|---|---|
generic.received | event | Generic sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature. |
Normalized payload
Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.
Normalized event
{
"id": "evt_demo",
"source": "generic",
"type": "generic.received",
"action": "received",
"deliveryId": "delivery_demo",
"subject": {
"title": "Generic HMAC event"
},
"raw": {}
}Filter and template examples
Filter
type equals "generic.received"Template
"Generic HMAC event: {{event.subject.title}}"Retries and the delivery log
408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Common errors
| Symptom | Fix |
|---|---|
SIGNATURE_INVALID | Use the signing secret Generic HMAC shows when the webhook is created, and send x-signature for the exact raw body. |
Nothing arrives | Confirm the webhook points at the endpoint's /in/<endpoint-id> URL and that the endpoint is active. |
Pair with a target
Reference
- Receiving eventshttps://hooks.events/docs/signatures.md
- Verify signatureshttps://hooks.events/docs/signatures.md
- Payload templateshttps://hooks.events/docs/templates.md
Other sources
<event>.<action> (for example issues.opened) before any destination filter runs.StripeA Hooks Stripe endpoint verifies Stripe-Signature as HMAC-SHA256 over <timestamp>.<raw body> with a five-minute tolerance, then normalizes each event to <resource>.<action> such as invoice.payment_failed.SlackA Hooks Slack endpoint verifies X-Slack-Signature as HMAC-SHA256 over v0:<timestamp>:<raw body>, answers the url_verification handshake itself, and normalizes messages to app_mention.received or message.<channel_type>.LinearA Hooks Linear endpoint verifies Linear-Signature as hex HMAC-SHA256 over the raw body, rejects payloads whose webhookTimestamp is more than 60 seconds old, and normalizes events to issue.create, issue.update, and comment.create.SentryA Hooks Sentry endpoint verifies Sentry-Hook-Signature as hex HMAC-SHA256 with the Integration's Client Secret, deduplicates by Request-ID, and normalizes events to issue.created or event_alert.triggered.GitLabGitLab project webhooks cover pushes, merge requests, pipelines, issues, notes, and releases.ShopifyShopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.IntercomIntercom sends conversation and contact notification topics, signed with the app client secret.ZendeskZendesk webhooks cover ticket, user, and organization events, signed with a timestamp plus body HMAC.JiraJira Cloud webhooks cover issue creation, updates, comments, and sprint changes.PagerDutyPagerDuty v3 webhooks cover incident trigger, acknowledge, resolve, and annotation events.Standard WebhooksStandard Webhooks deliveries carry webhook-id, webhook-timestamp, and base64 v1 signatures.SvixSvix Play and the Svix dispatcher use the Standard Webhooks headers with svix- prefixes.VercelVercel webhooks cover deployment, integration, project, and domain events.TwilioTwilio status callbacks cover messages, calls, and recordings, signed over the URL and form parameters.DiscordDiscord interaction webhooks use Ed25519 signatures plus a PING handshake.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.