---
slug: server-events-signatur
title: "How do I sign server-side requests?"
category: installation
locale: en
updated: 2026-10-12
keywords: ["signature","HMAC","replay","security","webhook","nonce"]
questions: ["How does the HMAC signature and replay protection work?","Compute HMAC signature","Replay protection","How do I secure the webhook?"]
url: https://bench.metrunio.com/en/help/server-events-signatur
---

# How do I sign server-side requests?

**How does the HMAC signature and replay protection work?**

Send the header x-metrunio-signature with a timestamp and an HMAC-SHA256 over "<timestamp>.<raw body>", computed with the server key. The time window is five minutes and each signature is accepted exactly once.

```text
x-metrunio-signature: t=<unix seconds>,v1=<hex>
v1 = HMAC-SHA256(server_key, "<t>.<raw body>")
```

- Sign the raw body, byte for byte, before any reformatting.
- The timestamp must be at most five minutes in the past or future.
- Each signature is accepted only once; a repeat yields REPLAY_DETECTED.
- For /v1/server/events the signature is optional; for /v1/webhooks/conversions it is required.

> **Caution:** If a framework reformats the body before signing (for example by re-serialising the JSON), the signature no longer matches. Sign exactly the bytes you send.

## Also asked

- Compute HMAC signature
- Replay protection
- How do I secure the webhook?

## Related

- https://bench.metrunio.com/en/help/server-events-api
- https://bench.metrunio.com/en/help/webhooks-conversions
- https://bench.metrunio.com/en/help/api-keys-rotieren