# Event notification endpoint URL - URL validation failed. Try again later Webhook Only App **URL:** \ **Category:** Webinars\ **Created:** [August 10, 2022, 7:41pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014 "2022-08-10T19:41:22Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 10, 2022, 7:41pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/1 "2022-08-10T19:41:22Z")
I have searched, but I cannot find an answer to this. I set up a webhook only app. I cloned the repo here. [GitHub - zoom/webhook-sample-node.js: Receive Zoom Webhooks](https://github.com/zoom/webhook-sample-node.js) both using the deploy button and the manual deploy. I was able to use my own values to ping the page from postman and I got a successful response, but I cannot get the app to validate. I realize that the plainToken value is different every time, but I have combed through the code and everything seems correct. I compared to the documentation and it looks like everything is there, so I can’t figure out what I’m doing wrong. ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 10, 2022, 11:10pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/2 "2022-08-10T23:10:09Z")
After looking at my Heroku logs I have verified that this is the issue. The signature hash doesn’t match the header value x-zm-signature. `if (req.headers['x-zm-signature'] === signature) {` This is the code that creates the signature hash `const hashForVerify = crypto.createHmac('sha256', process.env.ZOOM_WEBHOOK_SECRET_TOKEN).update(message).digest('hex')` ---
**Author:** ![joao.carvalho](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/joao.carvalho/32/40415_2.png) [@joao.carvalho](https://devforum.zoom.us/u/joao.carvalho)\ **Post date:** [August 11, 2022, 5:31pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/3 "2022-08-11T17:31:59Z")
I am facing the same issue here. Following the docs and creating a valid SHA256 Hex digest code does not validate the webhook event subscription. Does anyone solve this in any way? Any help will be apreciated Thanks in advance ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 11, 2022, 8:25pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/4 "2022-08-11T20:25:21Z")
Hey @salachniewicz , @joao.carvalho , Make sure you are setting your Webhook Secret Token in an environment variable named `ZOOM_WEBHOOK_SECRET_TOKEN `. The code in the sample should handle the rest. 🙂 > **[GitHub - zoom/webhook-sample-node.js: Receive Zoom Webhooks](https://github.com/zoom/webhook-sample-node.js#setup)** > > Receive Zoom Webhooks. Contribute to zoom/webhook-sample-node.js development by creating an account on GitHub. Please let me know if that helps! Thanks, Tommy ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 8:31pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/5 "2022-08-11T20:31:25Z")
Yes I did that. I even hard coded it in the index.js file to verify. I used postman and hard coding my own values I seem to be able to get it to give a valid response, but not when I test from zoom ---
**Author:** ![harold](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/harold/32/40337_2.png) [@harold](https://devforum.zoom.us/u/harold)\ **Post date:** [August 11, 2022, 8:42pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/6 "2022-08-11T20:42:57Z")
Hi @Stan many are having a problem validating and waiting on a solution so it may not be your issue. Here are my thoughts and am waiting on confirmation or contradiction. Best > [@Unable to save (Add or Edit) Event Subscriptions for Zoom App](https://devforum.zoom.us/t/unable-to-save-add-or-edit-event-subscriptions-for-zoom-app/73994/7): > > Hi @tommy, thank you for the response. There are multiple posts about this issue and I think @j11 is correct. In the docs it even says validate is not implemented yet, yet it is being required. Here are my thoughts in another post. Thank you for any escalation or acknowledgment of the issue. [https://devforum.zoom.us/t/is-lets-encrypt-certificate-authority-a-valid-ca-for-zoom-webhooks/74067/2?u=harold](https://devforum.zoom.us/t/is-lets-encrypt-certificate-authority-a-valid-ca-for-zoom-webhooks/74067/2) ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 8:45pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/7 "2022-08-11T20:45:24Z")
The thing is, I checked the Heroku logs and I can visibly verify that the signature and header don’t match. ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 8:53pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/8 "2022-08-11T20:53:42Z")
Happy to post screenshots of stuff if it helps. ---
**Author:** ![harold](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/harold/32/40337_2.png) [@harold](https://devforum.zoom.us/u/harold)\ **Post date:** [August 11, 2022, 8:53pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/9 "2022-08-11T20:53:45Z")
oh sorry you are asking about verifying and not validating. So probably not your issue. I was having the same issue verifying until I realized that the stucts (golang) I was building with the payload were not set up exactly the same as the webhook payload. I had to print out the payload and arrange my object to match it exactly so when I encoded they would match. also check if your signature string to be encoded looks similar to this `v0:{WEBHOOK_REQUEST_HEADER_X-ZM-REQUEST-TIMESTAMP_VALUE}:{WEBHOOK_REQUEST_BODY}` Example string with printed values: ```auto v0:1658940994:{"event":"session.started","payload":{"account_id":"{ACCOUNT_ID}","object":{"st ``` and comparing signature looks like this v0={HASHED\_MESSAGE} ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 11, 2022, 8:59pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/10 "2022-08-11T20:59:30Z")
Thanks @harold for pointing this out. The Webhook Secret Token is used for two things: 1. [Zoom Validating you control the endpoint URL](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#validate-your-webhook-endpoint) 2. [You validating the request came from Zoom](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#verify-webhook-events) It is important to understand that clicking the verify button in the marketplace webhook build flow triggers 1. -Tommy ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 9:00pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/11 "2022-08-11T21:00:54Z")
Well I’m specifically talking about the blue button when creating an event notification. Hope I didn’t word it wrong. Let me take a look at what you wrote and see if I notice an issue with what I have. ---
**Author:** ![harold](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/harold/32/40337_2.png) [@harold](https://devforum.zoom.us/u/harold)\ **Post date:** [August 11, 2022, 9:05pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/12 "2022-08-11T21:05:48Z")
the blue button is issue #1 which is the issue I am referring to. ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 9:13pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/13 "2022-08-11T21:13:51Z")
Ok so here’s the code, it’s straight from the github node app, I didn’t modify anything. const message = `v0:${req.headers['x-zm-request-timestamp']}:${JSON.stringify(req.body)}` const hashForVerify = crypto.createHmac(‘sha256’, ‘’).update(message).digest(‘hex’) const signature = `v0=${hashForVerify}` And when comparing that to the header, it seems to not match if (req.headers[‘x-zm-signature’] === signature) { Which I confirmed in the Heroku logs ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 9:15pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/14 "2022-08-11T21:15:31Z")
![error](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/0/0/0021bf061d824cffff4af34f141490b068ab7113.png) ---
**Author:** ![harold](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/harold/32/40337_2.png) [@harold](https://devforum.zoom.us/u/harold)\ **Post date:** [August 11, 2022, 9:29pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/15 "2022-08-11T21:29:58Z")
Yeah as Tommy said those are 2 different steps. Your code is for 2. [You validating the request came from Zoom](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#verify-webhook-events) the blue validate button is for 1. [Zoom Validating you control the endpoint URL](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#validate-your-webhook-endpoint) ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 11, 2022, 9:45pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/16 "2022-08-11T21:45:34Z")
Hey @salachniewicz , For validating the URL, just make sure you are following this if block step: > Thanks, Tommy ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 10:14pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/17 "2022-08-11T22:14:51Z")
Yea so that’s all there, I really wonder if the hash is right because the req.headers are not equal to the signature variable. But I see that that line is commented out on yours, should I do the same? ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 10:15pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/18 "2022-08-11T22:15:34Z")
So Harold are you saying this is a known issue and nothing I can do to fix at the moment? ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 10:18pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/19 "2022-08-11T22:18:04Z")
Here it is. Other than adding outputs to check the values, I haven’t changed a thing. ![code](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/5/9/594d171148f5e48337edf4a0a6f891f68d4ff540.png) ---
**Author:** ![salachniewicz](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/salachniewicz/32/34830_2.png) [@salachniewicz](https://devforum.zoom.us/u/salachniewicz)\ **Post date:** [August 11, 2022, 10:24pm UTC](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014/20 "2022-08-11T22:24:43Z")
I don’t know why I asked, I should have just done it. I commented the code at as seen in the screenshot above and it validates! Thank you all so much for your help! [Next page](https://devforum.zoom.us/t/event-notification-endpoint-url-url-validation-failed-try-again-later-webhook-only-app/74014.md?page=2)