# Authenticate webhook POST from Zoom **URL:** \ **Category:** API and Webhooks\ **Created:** [April 25, 2020, 8:55pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903 "2020-04-25T20:55:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![stevejohnson](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/stevejohnson/32/6992_2.png) [@stevejohnson](https://devforum.zoom.us/u/stevejohnson)\ **Post date:** [April 25, 2020, 8:55pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/1 "2020-04-25T20:55:58Z")
The documentation for webhooks at [https://marketplace.zoom.us/docs/api-reference/webhook-reference](https://marketplace.zoom.us/docs/api-reference/webhook-reference) says that an ‘authorization’ header is sent by Zoom and the value can be compared to the Verification token shown on the Features page of my Marketplace app. I have a number of webhooks being sent, none of which contain the ‘authorization’ header, that I can see. None of my logs show the verification token string being sent at all, anywhere in the POST request, as a header or otherwise. Am I missing something? I really need to authenticate POST requests to my endpoints; the only thing unique I see right now is a ‘clientid’ header. Any ideas? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [April 28, 2020, 9:11pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/2 "2020-04-28T21:11:30Z")
Hey @stevejohnson, What language are you using for your server? The verification token should be included, but depending on how you are receiving requests it could differ where in the header to find it. > [@Data Compliance API - Deauthorization Endpoint URL](https://devforum.zoom.us/t/data-compliance-api-deauthorization-endpoint-url/3870/15): > > Hey @john! You are correct, you will only receive the Deauthorization Event Notification Webhook with the Production version of your app. You can test this by installing the production version of your app via your apps publishable URL, [54%20PM] And then [uninstalling your app on your “Installed Apps” page.](https://marketplace.zoom.us/user/installed) I made a simple PHP web server and was able to see the Verification Token in the request headers (when testing a Zoom event/webhook sent to my server). Here is my code: Examp… Thanks, Tommy ---
**Author:** ![stevejohnson](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/stevejohnson/32/6992_2.png) [@stevejohnson](https://devforum.zoom.us/u/stevejohnson)\ **Post date:** [April 29, 2020, 4:38pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/3 "2020-04-29T16:38:56Z")
PHP This is output of PHP’s getallheaders() (sensitive values 'x’ed): Array ( [User-Agent] =\> Zoom Marketplace/1.0a [Connection] =\> Keep-Alive [Host] =\> [xxxxxx.net](http://xxxxxx.net) [Content-Length] =\> 290 [Content-Type] =\> application/json; charset=utf-8 [X-Zm-Trackingid] =\> Webhook\_409f4a3e202c4f39b3ca598e4ddaff38 [Clientid] =\> xxxxxxxxxxxxxxxxx ) And the relevant part of $\_SERVER (again, 'x’ed) [HTTP\_USER\_AGENT] =\> Zoom Marketplace/1.0a [HTTP\_CONNECTION] =\> Keep-Alive [HTTP\_HOST] =\> [xxxxxxxx.net](http://xxxxxxxx.net) [CONTENT\_LENGTH] =\> 290 [CONTENT\_TYPE] =\> application/json; charset=utf-8 [HTTP\_X\_ZM\_TRACKINGID] =\> Webhook\_409f4a3e202c4f39b3ca598e4ddaff38 [HTTP\_CLIENTID] =\> xxxxxxxxxxxxx ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 4, 2020, 11:15pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/4 "2020-05-04T23:15:36Z")
Hey @stevejohnson, I belive the issue is on your PHP server configuration side of things. Checkout this stackoverflow: > Thanks, Tommy ---
**Author:** ![stevejohnson](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/stevejohnson/32/6992_2.png) [@stevejohnson](https://devforum.zoom.us/u/stevejohnson)\ **Post date:** [May 4, 2020, 11:19pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/5 "2020-05-04T23:19:38Z")
Thanks for that, didn’t occur to me to look there. ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [May 7, 2020, 6:01pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/6 "2020-05-07T18:01:21Z")
Let me know if you resolve the issue @stevejohnson! 🙂 Thanks, Tommy ---
**Author:** ![stevejohnson](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/stevejohnson/32/6992_2.png) [@stevejohnson](https://devforum.zoom.us/u/stevejohnson)\ **Post date:** [June 8, 2020, 8:49pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/7 "2020-06-08T20:49:44Z")
Circling back around to this… Adding the following to .htaccess file worked. SetEnvIf Authorization “(.\*)” HTTP\_AUTHORIZATION=$1 If server configuration doesn’t allow SetEnvIf directives in .htaccess, may have to modify httpconf file. ---
**Author:** ![michael.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael.zoom/32/37213_2.png) [@michael.zoom](https://devforum.zoom.us/u/michael.zoom)\ **Post date:** [June 12, 2020, 3:55pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/8 "2020-06-12T15:55:52Z")
Glad it worked @stevejohnson! Thanks for helping Tommy! ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 10:00pm UTC](https://devforum.zoom.us/t/authenticate-webhook-post-from-zoom/14903/9 "2020-08-21T22:00:41Z")