Hi, I am experiencing issues authenticating webhook calls from chat agents, I have tried many thing but nothing seems to work, so I have gone low-level and unambiguous to test and prove with I believe is incorrect. Retell uses this for the key in the webhook if the documentation is correct: • Timestamp (v) : In milliseconds • Digest (d) : HMAC-SHA256 hex digest • Signed payload format: {timestamp}.{raw_body} — the timestamp concatenated with a period, then the raw request body using the raw request body (exact bytes as received), not a parsed/re-stringified JSON object. Re-serializing can change number formatting (e.g., exponential notation like 4.0000000126383384e-05), which breaks signature verification. Please see attached for more details of the issue. https://cdn.discordapp.com/attachments/1461790489169629449/1461790489387729079/message.txt?ex=6979adbb&is=69785c3b&hm=3062dd4a0cda64bbd45e045cf0298f2dbf374c13a29677477279af74d48bdc2f&

The documentation does not publicly specify the exact internal algorithm (timestamp + HMAC-SHA256 format you described). The docs only show how to use the SDK's verify function

That is what ai-evy has given us (see link), so in that case how do we authenticate without the use of the SDK? https://discord.com/channels/1186424376300679209/1461721086482714880/1461721169336995903

Ok, I’m escalating your request to our engineering team to provide a solution for this.

thank you

not yet team is looking into the issue

Hi @VI , we suggest to use our nodejs sdk for webhook payload verification and we can confirm the signature is valid.

@VI please take a look at our docs, let me know if you need assistance: https://docs.retellai.com/features/secure-webhook

Well, do Retell have an example of how to perform this without the SDK because platforms like cloudflare do not accept SDKs?

Why can’t you use the sdk?

Because platform we use (cloudflare workers) you cannot use SDK's?

I think you’re able to just npm install retellai-sdk?