Security
Klavi defaults to using the secretkey and SHA-256 HMAC algorithm to sign the payload.
The following parameter will be included in the request header that Klavi POST to you.
We recommend that you verify the signature of the webhook. Tips for Best Practice:
Create a SHA-256 HMAC of the request body using your secretKey as the key
Compare it to the signature included on the X-Klavi-Signature header. If the two are equal then the request is valid, otherwise, it is spoofed.
Store the eventId and ignore webhooks with an ID that have already been processed to prevent replay attacks.
The X-Klavi-Signature and X-Klavi-Timestamp header gets added to every event sent.
To ensure webhook notifications reach your webhook listener server, you must add the following Klavi IP addresses to your firewall’s allowlist:
Environment | IP Address |
|---|---|
Sandbox | 18.231.92.86 |
Testing | 18.231.92.86 |
Production | 18.230.43.17 |
No matter how you receive shared data, the export IP addresses for Klavi's various environments are as shown above. If partners have stricter security requirements, you can only allow access to the above IP addresses.
