---
title: Webhook Signing
url: https://docs.kaltura.com/docs/rich-media-cms-apis/integration/webhooks-signing
---

## Webhook Signing (HMAC Verification)

### Configure Signing

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/eventnotification_eventnotificationtemplate/action/update" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$TEMPLATE_ID" \
  -d "eventNotificationTemplate[objectType]=KalturaHttpNotificationTemplate" \
  -d "eventNotificationTemplate[signSecret]=your-webhook-secret" \
  -d "eventNotificationTemplate[secureHashingAlgo]=2"
```

### Verification Headers

Kaltura sends with each webhook request:

| Header | Value |
|--------|-------|
| `X-KALTURA-SIGNATURE` | `SHA256(signing_secret + raw_body)` — hex-encoded |
| `X-KALTURA-HASH-ALGO` | Hash algorithm used (e.g., `sha256`) |

The signing key is your `signSecret`. If no `signSecret` is configured, Kaltura uses your partner's admin secret.

### Verify on Your Server

The signature is SHA256 of the signing secret concatenated with the raw POST body (plain concatenation, not HMAC):

```bash
EXPECTED=$(echo -n "$\{SIGNING_SECRET\}$\{RAW_BODY\}" | sha256sum | cut -d' ' -f1)
```

Compare `$EXPECTED` with the `X-KALTURA-SIGNATURE` header value.