---
schema_version: "1"
id: b327cb8a279486b7a8720013ca01035488eb42f4ad0dc8918f4dfb010e41119e
title: Validating the Signature
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/references/webhook-data-action-targets/c360a-api-validating-the-signature.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/references/webhook-data-action-targets/c360a-api-validating-the-signature.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: acbe76bd2592f19cbb89d5173d9fe33bdd912106755fa2af24f6641100962bef
products:
  - Data 360 Integration Guide
  - Data 360 Developer Documentation
---
# Validating the Signature

To validate the signature, you can use this sample Java code. Make sure to perform JSON escaping on the payload received at the target.

This code includes the payload, signature received, and secret key. You can have similar code in your respective programming language.

```nolang
public static final String SIGNING_KEY_ALGO = "HMACSHA256";
public static boolean isSignatureValid(String payload, String receivedSignature, String signingKey) throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException {
     Mac mac = Mac.getInstance(SIGNING_KEY_ALGO);
     SecretKeySpec secretKeySpec =
             new SecretKeySpec(
                     signingKey.getBytes(StandardCharsets.UTF_8), SIGNING_KEY_ALGO);
     mac.init(secretKeySpec);

     String signature =
             org.apache.commons.codec.binary.Base64.encodeBase64String(mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));
     if(signature.equals(receivedSignature))
     {
         return true;
     }
     return false;
}

```

```nolang
import hmac
import hashlib
import base64
def is_signature_valid(payload: str, received_signature: str, signing_key: str) -> bool:
    # Create a new HMAC-SHA256 object using UTF-8 bytes of the key
    mac = hmac.new(signing_key.encode('utf-8'), digestmod=hashlib.sha256)
    # Feed in the UTF-8 bytes of the payload
    mac.update(payload.encode('utf-8'))
    # Base64-encode the resulting HMAC digest and decode back to a string
    computed_signature = base64.b64encode(mac.digest()).decode('utf-8')
    return hmac.compare_digest(computed_signature, received_signature)
```