generated: '2026-08-12'
method: searched
source: https://github.com/Doodles/webhook-example
docs: https://github.com/Doodles/webhook-example#signature-verification
scope: >-
  Covers the ONLY authenticated integration surface Doodles publishes — the outbound
  webhook contract. Doodles operates no public REST API, issues no API keys, and runs
  no OAuth 2.0 / OpenID Connect authorization server that could be discovered
  anonymously; /.well-known/openid-configuration and
  /.well-known/oauth-authorization-server were probed on www.doodles.app and
  stoodio.doodles.app and both hosts answered a 429 bot challenge rather than a
  document (see well-known/doodles-well-known.yml).
summary:
  types: [hmac-signature]
  api_key_in: []
  oauth2_flows: []
  bearer: false
  mutual_tls: false
schemes:
- name: webhookSignature
  type: hmac
  algorithm: HMAC-SHA256
  encoding: base64
  in: header
  parameter_name: x-signature
  signed_material: raw JSON request body
  key_material: shared secret provisioned out of band
  direction: inbound-to-your-receiver
  verification: constant-time compare; reject with HTTP 403 on mismatch
  sources: [https://github.com/Doodles/webhook-example]
not_found:
- {mechanism: apiKey, note: No public API key program or developer console was discoverable.}
- {mechanism: oauth2, note: No authorization/token endpoints published.}
- {mechanism: openIdConnect, note: /.well-known/openid-configuration answered 429 (bot challenge), not a document.}
- {mechanism: mutualTLS, note: Not documented.}