> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.nowbookit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Security

> How to verify and sign NowBookIt webhook payloads.

## Verifying Inbound Webhooks (Outbound direction)

When NowBookIt sends events to your callback URL, validate that the request genuinely came from NowBookIt before processing it.

<Note>
  NowBookIt's current outbound webhook security model uses a shared secret approach. Contact your partner manager for your webhook secret.
</Note>

## Signing Requests to NowBookIt (Inbound direction)

When your system calls NowBookIt's partner inbound endpoints, include an HMAC signature in the request header.

### Computing the Signature

<CodeGroup>
  ```javascript Node.js theme={null}
  const crypto = require('crypto');

  function computeHmac(secret, body, url) {
    const message = body + url;
    return crypto
      .createHmac('sha256', secret)
      .update(message)
      .digest('hex');
  }

  // Add to request headers:
  const signature = computeHmac(process.env.NBI_HMAC_SECRET, requestBody, requestUrl);
  headers['X-Partner-Signature'] = signature;
  ```

  ```python Python theme={null}
  import hmac
  import hashlib

  def compute_hmac(secret: str, body: str, url: str) -> str:
      message = (body + url).encode('utf-8')
      return hmac.new(
          secret.encode('utf-8'),
          message,
          hashlib.sha256
      ).hexdigest()

  signature = compute_hmac(os.environ['NBI_HMAC_SECRET'], request_body, request_url)
  headers['X-Partner-Signature'] = signature
  ```
</CodeGroup>

### Onboarding Checklist

Before go-live, confirm with your NowBookIt onboarding contact:

| Item                  | Description                                               |
| --------------------- | --------------------------------------------------------- |
| Signature header name | The header your system sends (e.g. `X-Partner-Signature`) |
| Shared HMAC secret    | Used to sign requests                                     |
| Partner identifier    | Your `partnerName` value for URL paths                    |
| Location mapping      | How your `locationId` values map to NowBookIt venues      |