https://retellai.com/?utm_source=discord&utm_medium=seo logo
Powered by
Webhook HMAC mismatch — none of the documented sig...
# ❓・bug-report
d
We are verifying manually using: HMAC_SHA256(RETELL_API_KEY, raw_body) HMAC_SHA256(RETELL_API_KEY, 
${timestamp}.${raw_body}
) HMAC_SHA256(RETELL_API_KEY, timestamp + raw_body) HMAC_SHA256(RETELL_API_KEY, JSON.stringify(parsedBody)) None match the received signature. Confirmed: - Using the API key with the webhook badge - Using full key with key_ prefix - Using raw body from req.text() - Using hex digest Question: Is Retell signing webhooks with a different secret than RETELL_API_KEY? Is there a separate internal signing key? Can you confirm definitively that the webhook signature secret is exactly the webhook-badge API key and nothing else? As of Feb 2026, what is the exact signing construction used in production?
c
we do not give out our exact encryption/decryption method
please refer to our sdk to verify signatures
d
We are using retell-sdk@5.0.0 and Retell.verify() does not exist. Can you confirm: The exact npm package name? The exact version where Retell.verify() exists? A working minimal Node.js example that compiles?
c
Copy code
js
// install the sdk: https://docs.retellai.com/get-started/sdk
import { Retell } from "retell-sdk";
import express, { Request, Response } from "express";

const app = express();
app.use(express.json());

app.post("/webhook", (req: Request, res: Response) => {
  if (
    !Retell.verify(
      JSON.stringify(req.body),
      process.env.RETELL_API_KEY,
      req.headers["x-retell-signature"] as string,
    )
  ) {
    console.error("Invalid signature");
    return;
  }
  const {event, call} = req.body;
  // process the webhook

  // Acknowledge the receipt of the event
  res.status(204).send();
});
o
Hello @dcitelly.Art-Intel , the team is working on it
d
Hi — quick clarification. We installed retell-sdk@5.1.0 from npm. At runtime, Retell.verify is not exported (it does not exist on the Retell object). The documentation shows: Retell.verify(body, apiKey, signature) But this method is not present in the published SDK version. Can you confirm: Which exact npm version exposes Retell.verify? Whether it is a static method or instance method? If the docs refer to a different package or internal version? We cannot use the SDK for verification because the method does not exist in the public package. Thanks.
c
can you try v4.66.0 for me
d
Thanks Colin — downgrading to v4.66.0 resolved the issue on our end. We were stuck on v5.1.0 where Retell.verify was not exported. Everything is working properly now. Really appreciate the help.
c
Of course, we’re going to try to fix 5.1.0 as soon as we can
r
I am also struggling with this, albeit somewhat different. Our production application is not written in Python or Node.js, making using either of these SDK’s impossible for our use case. What options are available for securing our webhook endpoint? We’re already comparing the IP address, but we need a way to secure and validate that the payload originated from Retell
c
this is not currently supported without the sdk
r
c
i believe thats just an ai generated response, you can try it, but let me confirm with the team
r
If authenticating a webhook event isn’t possible without use of an SDK, would it be possible to put some type of request into the backlog for a PHP SDK?
o
Hello @dcitelly.Art-Intel This is fixed update to 5.2.0
d
Thanks
PreviousNext
Powered by