---
updatedAt: 2026-05-20T16:31:15.000Z
---

Fetch the complete documentation index at: https://docs.blockdaemon.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Validate Message Origin

When you receive events through a webhook, you need to ensure the messages are actually from the event streaming and not from someone else. Each message from event streaming comes with a **signature** that helps you verify its origin.

## Steps to Validate the Message Signature

1. **Look for the Signature**: Every message from event streaming has a signature attached as an HTTP header with the key `x-bd-webhooks-signature`.
2. **Recreate the Signature**: You need to [recreate](https://docs.blockdaemon.com/reference/validate-message-origin#example-code-to-generate-the-signature) the signature on your side and compare it with the one that came with the message.
3. **Compare Signatures**: The message is valid if the recreated signature matches the one from the message. If there is no signature or the signatures don't match, ignore the message because it's not from event streaming.

## Signature Schematics

The message signature is an HMAC using the SHA-256 hashing algorithm. The key of the HMAC is the webhook secret, which is registered in its settings for event streaming. The same secret is used for the Challenge Response Check (CRC) as documented [here](https://docs.blockdaemon.com/reference/webhook-verification-process#step-2-challenge-response-check-crc).

The payload of the HMAC is the HTTP request body. The HMAC is then base64 encoded and prefixed with the string `sha256=`.

## Example Code to Generate the Signature

Here’s a simple example in Go to generate the signature:

```go
func GenerateSignature(mySecret string, payload \[]byte) string {  
	key := \[]byte(mySecret)  
	h := hmac.New(sha256.New, key)  
	h.Write(payload)  
	hash := h.Sum(nil)  
	encodedHash := base64.StdEncoding.EncodeToString(hash)  
	return "sha256=" + encodedHash  
}
```

## 👋 Need Help?

Contact us through [email](mailto:support@blockdaemon.com) or our [support page](https://www.blockdaemon.com/support) for any issues, bugs, or assistance you may need.