---
title: "Enable HMAC webhook digest"
method: PUT
path: "/v4/subscription"
tags: ["Notifications"]
---

# Enable HMAC webhook digest

`PUT /v4/subscription`

> This endpoint is compatible with our deprecated v3 Notifications product. To use it with v3, simply replace 'v4' with 'v3' in the request URL.

<p style="display: none">/v4/subscription</p>
<p>Enable HMAC hash ID on the fired webhooks from Tatum API.
In order to make sure that a webhook is sent by us, we have the possibility to sign it with the HMAC Sha512 Hex algorithm.<br/>
To verify that a webhook is sent by us
<ol>
<li>Get a webhook <b>x-payload-hash</b> header value and payload as it is as a JSON file.</li>
<li>Convert the HTTP webhook body to stringify JSON without any spaces. In JavaScript, you would do it like this <pre>JSON.stringify(req.body)</pre></li>
<li>Perform calculations on your side to create a digest using Secret Key, webhook payload in bytes and HMAC SHA512 algorithm. JavaScript example:
<pre>require('crypto').createHmac('sha512', hmacSecret).update(JSON.stringify(req.body)).digest('base64')</pre>.</li>
<li>Compare x-payload-hash header value with calculated digest as a Base64 string.</li></p>

## Request body

- HmacWebHook
  - `hmacSecret` string, required — Your HMAC secret password, which is used for signing the webhook payload.

## Response `204`

OK

## Other responses

- `401` — Unauthorized. Not valid or inactive subscription key present in the HTTP Header.
- `500` — Internal server error. There was an error on the server during the processing of the request.

---

[API](https://skmtc.net/tatum/apis/blockchain-data.md) · [All operations](https://skmtc.net/tatum/apis/blockchain-data/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tatum/blockchain-data/revisions/8622ee4b8fae/schema)