# Python webhook validation

**URL:** <https://devforum.zoom.us/t/python-webhook-validation/91228>\
**Category:** API and Webhooks\
**Created:** [July 3, 2023, 4:38pm UTC](https://devforum.zoom.us/t/python-webhook-validation/91228 "2023-07-03T16:38:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![angela83](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@angela83](https://devforum.zoom.us/u/angela83)\
**Post date:** [July 3, 2023, 4:38pm UTC](https://devforum.zoom.us/t/python-webhook-validation/91228/1 "2023-07-03T16:38:55Z")

</div>

Hi team

I am having an issue validating a webhook using the webhook secret token in Python in my Flask app. Whatever I try it is not matching the x-zm-signature received in the request header. I suspect it is something to do with the way the request body is read and used.

This is the code snippet that I am using. Any help appreciated.

#validate request came from Zoom  
content = json.dumps(request.json, separators=(‘,’, ‘:’))  
x\_zm\_signature = request.headers[‘x-zm-signature’]  
x\_zm\_request\_timestamp = request.headers[‘x-zm-request-timestamp’]  
message = “v0:{}:{}”.format(x\_zm\_request\_timestamp,content)  
hashed\_message = hmac.new(  
str(app\_config.ZOOM\_SECRET\_TOKEN),  
msg=message,  
digestmod=hashlib.sha256  
).hexdigest()  
signature = “v0={}”.format(hashed\_message)  
if x\_zm\_signature != signature:  
#request did not come via the zoom service  
status\_code = httplib.UNAUTHORIZED  
response = ‘error’  
return jsonify(response), status\_code

Thanks

---

<div class="post-metadata">

**Author:** ![angela83](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@angela83](https://devforum.zoom.us/u/angela83)\
**Post date:** [July 4, 2023, 9:38am UTC](https://devforum.zoom.us/t/python-webhook-validation/91228/2 "2023-07-04T09:38:33Z")

</div>

for whoever is facing this issue, I was able to resolve it by using request.data when constructing the message instead of using request.json

message = “v0:{}:{}”.format(x\_zm\_request\_timestamp,request.data)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [July 7, 2024, 1:14am UTC](https://devforum.zoom.us/t/python-webhook-validation/91228/3 "2024-07-07T01:14:37Z")

</div>

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.