# Webhook verification failed due to special characters in payload

**URL:** <https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972>\
**Category:** Authentication\
**Created:** [September 15, 2022, 9:21am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972 "2022-09-15T09:21:57Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahul.bhooteshwar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/rahul.bhooteshwar/32/41425_2.png) [@rahul.bhooteshwar](https://devforum.zoom.us/u/rahul.bhooteshwar)\
**Post date:** [September 15, 2022, 9:21am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/1 "2022-09-15T09:21:57Z")

</div>

We have recently integrated Zoom WebHook validation process at our application end.  
We followed the process mentioned in official documentation :

[Verify Zoom Web Hooks](https://marketplace.zoom.us/docs/api-reference/webhook-reference/#verify-webhook-events)

Everything worked fine & we are able to successfully validate the calls received from Zoom Webhook.

But signature validation fails in very specific scenarios - in case of meeting related events :

Our Observation during failure :

- Meeting contains external participants (outside our company)
- Those external participants have special characters like emojis in their name,  
e.g. Elie Guez - ChoYou 🦩, Ahad 🎶 etc.
- External participant’s email is missing from payload

Please help.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [September 15, 2022, 1:28pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/2 "2022-09-15T13:28:10Z")

</div>

Hi @rahul.bhooteshwar  
Thanks for reaching out to the Zoom Developer Forum, I am happy to help here!  
So, let me just confirm if I am understanding correctly.

You are generating the signature to validate the webhook correctly (with the Zoom secret token), but this signature is invalid when these 3 scenarios are in place:

- Meeting contains external participants (outside our company)
- Those external participants have special characters like emojis in their name,  
e.g. Elie Guez - ChoYou 🦩, Ahad 🎶 etc.
- External participant’s email is missing from payload

Are you generating the signature like this:

```auto
const crypto = require('crypto')

const message = `v0:${request.headers['x-zm-request-timestamp']}:${JSON.stringify(request.body)}`

const hashForVerify = crypto.createHmac('sha256', ZOOM_WEBHOOK_SECRET_TOKEN).update(message).digest('hex')

const signature = `v0=${hashForVerify}`

if (request.headers['x-zm-signature'] === signature) {
  // Webhook request came from Zoom
} else {
  // Webhook request did not come from Zoom
}

```

---

<div class="post-metadata">

**Author:** ![rahul.bhooteshwar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/rahul.bhooteshwar/32/41425_2.png) [@rahul.bhooteshwar](https://devforum.zoom.us/u/rahul.bhooteshwar)\
**Post date:** [September 15, 2022, 3:19pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/3 "2022-09-15T15:19:59Z")

</div>

@elisa.zoom yes that’s correct.  
I am using exactly same code for verification.  
It works fine all the times except the scenario mentioned.

I don’t know if all those 3 conditions are responsible for the failure or just one of those (most probably user name with special characters).

I guess it is not applicable for our internal users as their names are proper alphabetical words & contains no emojis. But external meeting participants have their choice of names (containing these emojis).

Please let me know if anything else is needed from my side.

This is a critical issue for our integrations. Please help.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [September 17, 2022, 12:11am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/4 "2022-09-17T00:11:24Z")

</div>

Thanks for confirming this @rahul.bhooteshwar

Allow me some time to do some testing on my end and I will come back to you with an update shortly.  
Best,  
Elisa

---

<div class="post-metadata">

**Author:** ![rahul.bhooteshwar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/rahul.bhooteshwar/32/41425_2.png) [@rahul.bhooteshwar](https://devforum.zoom.us/u/rahul.bhooteshwar)\
**Post date:** [September 24, 2022, 3:03am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/5 "2022-09-24T03:03:59Z")

</div>

Hello @elisa.zoom ,  
Did you get a chance to test and confirm this behaviour?

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [September 26, 2022, 1:22pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/6 "2022-09-26T13:22:12Z")

</div>

Hi @rahul.bhooteshwar  
Thank you for your patience while I troubleshoot this on my end  
Unfortunately, I have not been able to replicate this behavior.  
I will go ahead and send you a private message so we can exchange more information

Best,  
Elisa

---

<div class="post-metadata">

**Author:** ![tech-zoom\_zp](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tech-zoom\_zp](https://devforum.zoom.us/u/tech-zoom_zp)\
**Post date:** [February 21, 2023, 4:42am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/7 "2023-02-21T04:42:54Z")

</div>

@elisa.zoom  
We have the same situation here.  
Please could you tell me all the logic for encoding?  
We use Python.

**how to reproduce**

- prepare 2 devices
  - one is logged in (device\_1)
  - the other is not logged in (device\_2)

  - I’m using iPad Zoom App for device\_2

- start a meeting using device\_1
- join the meeting using device\_2
  - tap on “Join Meeting”
  - type in Meeting ID (10 digits of numbers)
  - change the display name like “Masahiro’s iPad💻”
  - tap on “Join”

- “meeting.participant\_joined” webhook’s secret\_token validation fails

**failing webhook’s request body**  
I’ve masked certain parameters.  
Validation succeeds if the user\_name does not contain emoji.

```auto
{
    "payload": {
        "account_id": "xxxxxxxxxxxxxxxxxxxxxx",
        "object": {
            "duration": 0,
            "start_time": "2023-02-21T04:27:43Z",
            "timezone": "Asia/Tokyo",
            "topic": "Masahiro Yamamotoのパーソナルミーティングルーム",
            "id": "0000000000",
            "type": 4,
            "uuid": "IMDA4t/JQ9aZ0qjsAssdqg==",
            "participant": {
                "user_id": "00000000",
                "user_name": "山本昌弘のiPad💻",
                "id": "",
                "join_time": "2023-02-21T04:28:26Z",
                "email": "",
                "participant_uuid": "xxx-xxxxxx-xxxxxxxxxxx"
            },
            "host_id": "xxxxxxxxxxxxxxxxxxxxxx"
        }
    },
    "event_ts": 1676953710373,
    "event": "meeting.participant_joined"
}

```

**The python code we use for verification (Only the encoding part)**  
We use “ensure\_ascii=False” in json.dumps to encode kanji and kana characters correctly

```auto
import hmac
import json
from hashlib import sha256

json_request = json.dumps(request.body, separators=(',', ':'), ensure_ascii=False)
message = f"v0:{timestamp}:{json_request}"
hashed_message = f"v0={hmac.new(secret_token.encode(), message.encode(), sha256).hexdigest()}"

```

---

<div class="post-metadata">

**Author:** ![tech-zoom\_zp](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tech-zoom\_zp](https://devforum.zoom.us/u/tech-zoom_zp)\
**Post date:** [March 14, 2023, 3:14am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/8 "2023-03-14T03:14:29Z")

</div>

Hello, @elisa.zoom  
Could you help me with this?

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [March 14, 2023, 10:05pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/9 "2023-03-14T22:05:32Z")

</div>

Hi @tech-zoom_zp  
Thanks for reaching out to the Zoom Developer Forum, I am happy to help here! I have created an internal ticket (ZOOM- 506645) about this issue and will update you shortly  
Bes,t  
Elisa

---

<div class="post-metadata">

**Author:** ![tech-zoom\_zp](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tech-zoom\_zp](https://devforum.zoom.us/u/tech-zoom_zp)\
**Post date:** [June 6, 2023, 8:05am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/10 "2023-06-06T08:05:28Z")

</div>

Hi @elisa.zoom  
It’s been a long while without any further information.  
Should I ask at some other place?

Hope you could help me before October.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [June 6, 2023, 3:55pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/11 "2023-06-06T15:55:36Z")

</div>

I am sorry I did not get back to you!  
I will take a look at the internal ticket to see if there was any movement and will come back to you

---

<div class="post-metadata">

**Author:** ![tech-zoom\_zp](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tech-zoom\_zp](https://devforum.zoom.us/u/tech-zoom_zp)\
**Post date:** [September 21, 2023, 5:33am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/12 "2023-09-21T05:33:11Z")

</div>

@elisa.zoom

Hi. I haven’t gotten any answer yet. I had presumed that a solution you private mailed to Mr. Rahul Bhooteshwar could be used for our case, too. Is the situation so complicated?  
It’s stressful getting reminder emails to update webhook verification and always reminding the deadline to myself. Once I have the answer and be done with it, I can forget about the deadline altogether.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [September 21, 2023, 3:00pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/13 "2023-09-21T15:00:26Z")

</div>

Hi @tech-zoom_zp  
I totally understand your point.  
I did not update the thread since I do not see any movement on the internal ticket I created.  
I just re-engaged with the team and will push to get an answer soon.  
Also, the dates for deprecation has been pushed to Februrary next year

> **[Using webhooks](https://developers.zoom.us/docs/api/rest/webhook-reference/#verify-webhook-events)**
>
> The Zoom Developer Platform is an open platform that allows third-party developers to build applications and integrations upon Zoom’s video-first unified communications platform.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [September 25, 2023, 4:04pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/14 "2023-09-25T16:04:00Z")

</div>

Hi again @tech-zoom_zp  
I heard back from our Engineering team and it looks like when the emoji is a Unicode string we support it’s validation. In the case of this emoji 💻, my team was able to test and able to verify the webhook.

---

<div class="post-metadata">

**Author:** ![tech-zoom\_zp](https://avatars.discourse-cdn.com/v4/letter/t/5fc32e/32.png) [@tech-zoom\_zp](https://devforum.zoom.us/u/tech-zoom_zp)\
**Post date:** [September 27, 2023, 5:15am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/15 "2023-09-27T05:15:36Z")

</div>

@elisa.zoom

Thanks for reply!

I tried on my end again, but un-successful.  
Could you tell me what is wrong with my python code? It fails only when the request body includes an Unicode emoji.

**The python code I use for verification.**

```python
import hmac
import json
from hashlib import sha256

class HasVerifiedZoomSignature(BasePermission):
    def has_permission(self, request, view):
        secret_token = settings.ZOOM["SECRET_TOKEN"]
        timestamp = request.headers.get("x-zm-request-timestamp")
        signature = request.headers.get("x-zm-signature")

        json_request = json.dumps(request.data, separators=(",", ":"), ensure_ascii=False)
        message = f"v0:{timestamp}:{json_request}"
        hashed_message = f"v0={hmac.new(secret_token.encode(), message.encode(), sha256).hexdigest()}"

        result = signature == hashed_message
        return result

```

Edit: I believe the case is the same as [this one (the solution is not explained in the thread, though).](https://devforum.zoom.us/t/unable-to-verify-zoom-event-webhooks-if-body-contains-emojis/82638)

---

<div class="post-metadata">

**Author:** ![ymnoor21](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ymnoor21/32/52939_2.png) [@ymnoor21](https://devforum.zoom.us/u/ymnoor21)\
**Post date:** [October 11, 2023, 10:52pm UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/16 "2023-10-11T22:52:30Z")

</div>

Same here. I’m getting signature mismatch error when `data` has a Spanish tilde accent mark in it. But in all other cases the signature matches. Here’s my Python code:

```python
        x_zm_signature = headers['X-Zm-Signature']
        x_zm_request_timestamp = request.headers['X-Zm-Request-Timestamp']

        data = request.get_json()

        message = "v0:{}:{}".format(x_zm_request_timestamp, json.dumps(data, separators=(',', ':'))).encode('utf-8')

        hashed_message = hmac.new(secret_token, msg=message, digestmod=hashlib.sha256).hexdigest()

        signature = "v0={}".format(hashed_message)

        if x_zm_signature != signature:
            ......

```

---

<div class="post-metadata">

**Author:** ![dimaqq](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@dimaqq](https://devforum.zoom.us/u/dimaqq)\
**Post date:** [January 12, 2024, 5:02am UTC](https://devforum.zoom.us/t/webhook-verification-failed-due-to-special-characters-in-payload/75972/17 "2024-01-12T05:02:34Z")

</div>

Given that @ymnoor21 reports accent mark (as opposed to emoji), the difference probably lies in either of:

- unicode normal form (composed vs decomposed), or
- escaping JSON content

Ideally the hash should be computed over the raw request body, as opposed to parsed request JSON.  
However that assumes Zoom computing the hash over exact request body that’s sent out.

Perhaps Zoom folks could share the snippet of the code on their side, incl. runtime (python/nodejs/golang/etc.) and library (requests?httpx?fetch api?) versions? That would help.

With a bunch of smart developers in this forum, I’m pretty sure this can be solved really fast with just a bit of raw data 🙇‍♂️