Webhook callback authentication

i am trying to work with smartsheet webhooks. Would like to use the callback authentication feature as explained at http://smartsheet-platform.github.io/api-docs/#authenticating-callbacks-optional.

However, the instructions are not very clear of how to calculate the HMAC value from sharedSecret and request body. For example, do i need to concatenate these two using '|' operator or something else.

I am using Node.Js to test this out. I would really appreciate if an example can be provided to calculate the HMAC value which I can refer OR update the website documentation with explicit steps to follow.

Thanks

Find more posts tagged with

Sheets

Product Development

Comments

amitk-productiv

Made it work. Was doing some silly mistakes.

rammohanvarma

Amitk,

I'm also trying to authenticate callbacks and implemented hmac calculation in Kotlin. when trying to compare Smartsheet-Hmac-SHA256 header of the request with hmac value they are not matching (simple equality comparison) even though request is originated from smartsheet. How did you make it work?

rammohanvarma

Amitk,

jameskyle

How did you make it work? I'm using the sharedSecret, but not sure which part of the body to use or to contact to the shareSecret.

In the body request, i get an object like:

{

nonce: '....,

timestamp: '2020-01-27T21:25:53.736+0000',

webhookId: .....,

scope: 'sheet',

scopeObjectId: ...,

events : [{....}]

}

Would appreciate your input on this. Thanks.

Dylan

I came across this same problem and thought I'd post my solution for any future viewers.

An HMAC is a message authentication code that uses a key, a message, and a crypto function to create a hash of the key and message combination.

For example, the 16 bit (hex) digest resulting from the string "apple" as a key and the string "banana" as the message put through the SHA256 algorithm is "8656aeea5d6a2a225f13fc5b03117e21d6398018352597317b451122ab7fbb4f". Try it on this website: https://www.freeformatter.com/hmac-generator.html

You'll need to create an HMAC hex digest using the webhook's shared secret as the key, the bytes data of the smartsheet callback body as the message, and the SHA256 algorithm as the cryptographic function. You can then compare this against the Smartsheet-Hmac-SHA256 header of the request.

Hope this helps!

Sign in to join the conversation!

Quick Links

Trending discussions

Stopping current users from automatically adding new users to Smartsheet
Hi all, Currently on a business plan. How do I stop current users from sharing sheets with other users who have not been officially onboarded into the system by admin? This is driving up our license count and I am trying to stop this from happening. Is this even possible or is it one of Smartsheet's "quirks" (this is…
Does the change in value within a formula not count as a change?
I'm trying to create an automation. In this automation, I want to copy rows when a value changes based on a formula (a count from another sheet), but the automation isn't triggering. What could be causing this issue?
Automation History
How can I validate or identify if an automation was triggered and when? Or if it failed?