# Atlas Webhook HMAC Signature Verification > Source-anchored research for Atlas Webhook HMAC Signature Verification. Run status: COMPLETED. Parent: [MongoDB Atlas on GCP](https://llms-explorer.com/tree/mongodb-atlas-on-gcp/) · 3 facets · 8 facts · page: https://llms-explorer.com/tree/atlas-webhook-hmac-signature-verification/ ## Measurements and reference values - The integration API specifies fallback to default headers when a header template fails, exceeds 4 KB, or produces an invalid JSON name-to-value object. Receivers must not assume template-provided authentication headers are invariably present. (low confidence) (verified as of 2026-10-29) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupintegration) ## Comparisons and alternatives - The Webhook Secret field generates a signature rather than transmitting a bearer token. Atlas also documents FreeMarker header and body templates, so the secret-field limitation alone does not establish a universal proxy requirement. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md) - HMAC depends on a shared secret, rather than a public verification key. RFC 2104 calls for randomly generated keys, secrecy protection and periodic refresh; apply this key-management guidance to the Atlas signing secret. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md) ## Facts and statements - With a webhook secret configured, Atlas documents X-MMS-Signature as the Base64 HMAC-SHA-1 of the request body; verification recomputes it with that secret and compares the header. Without a configured secret the signature header is optional. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md) - Implementation advice: retain the original request-body bytes before JSON parsing. With a compatible Node.js crypto build, createHmac('sha1', secret).update(rawBody).digest('base64') implements the documented calculation; reserialization can change signed bytes. This is a derived implementation, not an Atlas-provided code sample. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md) - Node.js timingSafeEqual compares bytes in constant time and is suitable for HMAC digests. Its inputs must have equal byte lengths or it throws. Validate lengths first; the surrounding verifier still needs review for timing leaks. (low confidence) — [source](https://nodejs.org/api/crypto.html) - The Atlas verification procedure describes a MAC of the body and no separate signed delivery timestamp or replay-rejection window. Inference: a matching signature alone does not establish delivery freshness; replay handling requires a receiver policy. This is a documentation boundary, not a demonstrated Atlas vulnerability. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md) - The integration API documents custom header templates, but excludes the webhook secret and signature from template variables. Therefore, neither universal bearer-header impossibility nor a mandatory proxy follows from the signing-secret restriction. (medium confidence) (verified as of 2026-10-29) — [source](https://www.mongodb.com/docs/atlas/tutorial/webhook-integration.md)