I have been using QuickAlerts to track activities on my smart contract and receive a WebHook in my Discord server. How can I make sure that the WebHook is indeed coming from QuickAlerts and not a hacker/scammer? - Tien

1 Answer 1


Each QuickAlerts WebHook payload has a unique set of signatures, using which you can verify if the payload is trusted.

Here's an example in JavaScript to verify signature in the payload:

const crypto = require('crypto');

const secret = 'your_security_token';
const givenSign = req.headers['x-qn-signature'];
const nonce = req.headers['x-qn-nonce'];
const contentHash = req.headers['x-qn-content-hash'];
const timestamp = req.headers['x-qn-timestamp'];

const hmac = crypto.createHmac('sha256', secret);
hmac.update(nonce + contentHash + timestamp);

const expectedSign = hmac.digest('base64');

if (givenSign === expectedSign) {
  console.log('The signature given matches the expected signature and is valid.');
} else {
  console.log('The signature given does not match the expected signature and is invalid.');

For more info on signatures and to check examples in other languages, check out docs: https://www.quicknode.com/docs/quickalerts/quickalerts-destinations/webhooks/webhook-signature

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.