Skip to main content
View as Markdown

Webhook Signing - Integration

Webhook Signing (HMAC Verification)​

Configure Signing​

curl -X POST "$KALTURA_SERVICE_URL/service/eventnotification_eventnotificationtemplate/action/update" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$TEMPLATE_ID" \
  -d "eventNotificationTemplate[objectType]=KalturaHttpNotificationTemplate" \
  -d "eventNotificationTemplate[signSecret]=your-webhook-secret" \
  -d "eventNotificationTemplate[secureHashingAlgo]=2"

Verification Headers​

Kaltura sends with each webhook request:

HeaderValue
X-KALTURA-SIGNATURESHA256(signing_secret + raw_body) — hex-encoded
X-KALTURA-HASH-ALGOHash algorithm used (e.g., sha256)

The signing key is your signSecret. If no signSecret is configured, Kaltura uses your partner's admin secret.

Verify on Your Server​

The signature is SHA256 of the signing secret concatenated with the raw POST body (plain concatenation, not HMAC):

EXPECTED=$(echo -n "$\{SIGNING_SECRET\}$\{RAW_BODY\}" | sha256sum | cut -d' ' -f1)

Compare $EXPECTED with the X-KALTURA-SIGNATURE header value.