diff --git a/docs/webhooks/04-Signatures.md b/docs/webhooks/04-Signatures.md index b2c2f8c..85c2027 100644 --- a/docs/webhooks/04-Signatures.md +++ b/docs/webhooks/04-Signatures.md @@ -48,6 +48,14 @@ If at least one of the signatures matches, the webhook should be considered a tr > Note: When comparing signatures, be sure to use a constant-time string comparison to protect against timing attacks. + +> Verifying PagerDuty webhook signatures requires the unaltered raw body of the request sent to you. +> Ensure that any frameworks or middleware you are using have not manipulated or formatted the request body. + + +> PagerDuty webhook payloads support unicode characters. If your implementation is converting the request body +> from string to bytes [or vice-versa], ensure that you are using the proper UTF-8 character encoding. + ## Examples of webhooks signing