Why I Signed My Netlify Webhooks

When I moved my personal site to Netlify I also wanted the same deployment to trigger a few home‑automation scripts that run on a Raspberry Pi in my garage. A simple HTTP POST would work, but anyone who discovers the endpoint could fire my scripts at will. The solution I settled on is a classic HMAC signature plus a short‑lived timestamp. It’s cheap, stateless, and works well with the serverless functions Netlify provides.

The Core Idea

Shared secret – a random string known only to the Netlify site and my home server.

HMAC‑SHA256 – the payload (or a deterministic string) is signed with the secret.

Timestamp – added to the request and validated to prevent replay attacks.

When the request arrives, the server recomputes the HMAC and compares it to the header.…