X-NICE-Webhook-Signature HMAC mismatch on replay window verification

The X-NICE-Webhook-Signature header keeps failing the HMAC-SHA256 check against the raw body. Step one: the SNIPPET action grabs the incoming payload and routes it to a local listener. We’re running crypto.createHmac(‘sha256’, secret).update(body).digest(‘hex’) but the strings never align. Frustrating stuff.

The thirty-second replay window should hold, yet the verification block drops every event after 14:00 GMT. Looks like the REST Proxy is truncating the hex output before it hits our validation logic.

Check your body encoding. Node’s update() expects a buffer or string, but if you’re passing raw bytes from the HTTP stream without decoding to UTF-8 first, the HMAC will differ. Try crypto.createHmac('sha256', secret).update(body, 'utf8').digest('hex').