Verifying Genesys Cloud Webhook Signature Headers for Replay Protection

Why does this signature verification logic fail intermittently during high-volume event ingestion? I am building a Python consumer for Genesys Cloud webhooks to feed sentiment models. I extract the x-genesys-signature header and compare it against an HMAC-SHA256 of the raw body using my client secret. Occasional mismatches occur despite valid secrets.

import hmac, hashlib
sig = request.headers.get('x-genesys-signature')
expected = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
assert sig == expected

Is there a specific timestamp validation requirement I am missing?

This looks like a clock-skew issue. Genesys signs payloads with a timestamp window. If your Lambda processes events slowly or the clock drifts, the signature check fails.

• Verify the x-genesys-timestamp header matches the signature scope.
• Allow a 300-second window for replay protection.
• Use this Node.js snippet for your handler:

const crypto = require('crypto');
const valid = crypto.timingSafeEqual(
 Buffer.from(sig), 
 Buffer.from(crypto.createHmac('sha256', secret).update(payload).digest('base64'))
);