Signature

Gearment signs the exact raw request bytes with HMAC-SHA256. Do not parse and serialize JSON again before calculating the signature.

Headers We Send

Header	Meaning
`X-Connect-Timestamp`	Unix timestamp in seconds when Gearment sent the request.
`X-Connect-Nonce`	Base64 URL encoded random nonce for this delivery.
`X-Connect-Signature`	Base64 URL encoded HMAC-SHA256 signature.
`X-Connect-Client-Key`	Gearment API key associated with the delivery.

Locating the Webhook Security Token

Use the API signature associated with the webhook client as the HMAC key. Keep it in your server-side secret store and never expose it in browser code, logs, or source control.

Signature Construction Logic

Build the signing input in this exact order:

request_path
+ nonce
+ timestamp
+ base64url(raw_request_body)

Calculate HMAC-SHA256 with the API signature as the HMAC key, then Base64 URL encode the digest.

Verifying a Payload

Calculate the signature from the exact raw request bytes before parsing JSON. Compare the result with X-Connect-Signature using a constant-time comparison, then enforce a bounded timestamp window and a one-time nonce policy.