Title: Webhook Signature add-on for Gravity Forms Author: danielboven Published: February 17, 2021 Last modified: February 17, 2021 --- Search plugins This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. ![](https://s.w.org/plugins/geopattern-icon/gf-webhook-signature.svg) # Webhook Signature add-on for Gravity Forms By [danielboven](https://profiles.wordpress.org/danielboven/) [Download](https://downloads.wordpress.org/plugin/gf-webhook-signature.zip) * [Details](https://en-au.wordpress.org/plugins/gf-webhook-signature/#description) * [Reviews](https://en-au.wordpress.org/plugins/gf-webhook-signature/#reviews) * [Installation](https://en-au.wordpress.org/plugins/gf-webhook-signature/#installation) * [Development](https://en-au.wordpress.org/plugins/gf-webhook-signature/#developers) [Support](https://wordpress.org/support/plugin/gf-webhook-signature/) ## Description This plugin can sign the webhook events sent by the Gravity Forms WebHooks Add-On to your endpoints by including a signature in each event’s `X-Gform-Signature` header. This allows you to verify that the events were sent by the Gravity Forms add-on, not by a third party. As of right now, you must verify the signatures by manually using your own solution. However, an example of a Node.js (JavaScript) implementation is linked below. Before you can verify signatures, you need to retrieve your endpoint’s public key( more information at [this question](https://en-au.wordpress.org/plugins/gf-webhook-signature/?output_format=md#how%20can%20i%20verify%20the%20signature%3F)). This plugin uses the same keys for every form and endpoint, meaning that the same keys will be used for every signature generated. ### Verification implementations * **Node.js:** See the example on [Github](https://github.com/danielboven/gravity-forms-webhook-signature/blob/main/examples/NODE_JS.md). ## Installation 1. Upload this plugin to your WordPress website 2. Activate the plugin through the ‘Plugins’ menu in WordPress 3. Navigate to the _Settings_ section 4. Click on the button _Generate a new public – private key pair_, or paste your own in the fields above and save ## FAQ ### How can I verify the signature? Navigate to the plugin settings. Copy the key in the _Public Key_ field to your own application (receiver). Use it to verify the signature. ### What format can I use for custom key Keys that are generated by the plugin have the following format: – **Digest algorithm:** SHA256 – **Private key type:** RSA (OPENSSL_KEYTYPE_RSA) – **Private key bits:** 1024 It is therefore advised that in case you use custom keys, you use a similar format, since no other format than the one above has been tested. You also have to include the **BEGIN** and **END** lines, for example: **Public Key:** `-----BEGIN PUBLIC KEY----- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXX -----END PUBLIC KEY----- ### How can I send feedback or get help with a bug? I’d love to hear your bug reports, feature suggestions and any other feedback! Please head over to [the GitHub issues page](https://github.com/danielboven/gravity-forms-webhook-signature/issues) to search for existing issues or open a new one. While I’ll try to triage issues reported here on the plugin forum, you’ll get a faster response (and reduce duplication of effort) by keeping everything centralized in the GitHub repository. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Webhook Signature add-on for Gravity Forms” is open source software. The following people have contributed to this plugin. Contributors * [ danielboven ](https://profiles.wordpress.org/danielboven/) [Translate “Webhook Signature add-on for Gravity Forms” into your language.](https://translate.wordpress.org/projects/wp-plugins/gf-webhook-signature) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/gf-webhook-signature/), check out the [SVN repository](https://plugins.svn.wordpress.org/gf-webhook-signature/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/gf-webhook-signature/) by [RSS](https://plugins.trac.wordpress.org/log/gf-webhook-signature/?limit=100&mode=stop_on_copy&format=rss). ## Meta * Version **1.0** * Last updated **6 years ago** * Active installations **Fewer than 10** * WordPress Version ** 4.0 or higher ** * Tested up to **5.6.22** * PHP Version ** 7.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/gf-webhook-signature/) * Tags * [forms](https://en-au.wordpress.org/plugins/tags/forms/)[gravity](https://en-au.wordpress.org/plugins/tags/gravity/) [request](https://en-au.wordpress.org/plugins/tags/request/)[verify](https://en-au.wordpress.org/plugins/tags/verify/) [webhook](https://en-au.wordpress.org/plugins/tags/webhook/) * [Advanced View](https://en-au.wordpress.org/plugins/gf-webhook-signature/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/gf-webhook-signature/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/gf-webhook-signature/reviews/) ## Contributors * [ danielboven ](https://profiles.wordpress.org/danielboven/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/gf-webhook-signature/)