Python

GitHub webhook with FastAPI

Calculate the HMAC with await request.body and compare the signature before deserializing.

Code sample

Webhook endpoint

Code samples, header names, event names, and signatures remain verbatim across locales.

import hashlib, hmac, json, os
from fastapi import FastAPI, Header, HTTPException, Request, status

app = FastAPI()

@app.post('/webhooks/github', status_code=status.HTTP_202_ACCEPTED)
async def github_webhook(request: Request, x_hub_signature_256: str = Header(default=''),
    x_github_delivery: str = Header(default=''), x_github_event: str = Header(default='')):
    body = await request.body()
    digest = hmac.new(os.environ['GITHUB_WEBHOOK_SECRET'].encode(), body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(f'sha256={digest}', x_hub_signature_256):
        raise HTTPException(status_code=401)

    await enqueue(x_github_delivery, x_github_event, json.loads(body))
    return {'accepted': True}

Setup steps

Verify the first delivery

Setup steps 1

Create a workspace in DevLog and copy the endpoint and Secret.

Setup steps 2

Configure the same Secret in GitHub and in your application’s secure environment variable.

Setup steps 3

Send a ping and confirm the signature, Delivery ID, and payload in the inbox.

Start free User guide