---
updatedAt: 2025-11-17T01:54:37.000Z
agentTools:
  projectIndex: https://docs.getorbital.com/llms.txt
---

# Verify Webhook Notification

```javascript JavaScript
const crypto = require('crypto');

const data = {
  "id": "d3da3a8d-1e4b-4a24-a2e5-1da62934c169",
  "externalId": "ORBITAL-CUSTOMER-REFERENCE-0001",
  "status": "initiated",
  "type": "deposit",
  "updatedAt": "2025-09-03T09:29:31.946Z",
  "event": "crypto_payment_status_updated"
}

const signature =
  'd9dnS7vz4zw6erJdvBDY2w3Yk6VJj+O/51VcJJcBaoYYDZXg8Xt1pGgTwDcDTV+ohxEOY6MmJUX7jgC22KoN7jXbj5WLSAdwyZJPlnjX1btMDneCrr/2K33+fubcggd0ER3hhqHYRA2RjiXv142dcK9IVVDWSzTS00K0zIGyal27gFfgPMOmmB8nvzryME5/d5vZnPWizhpjbnzvZyGSI6CDZ+MovkhmgAvdHfrxdTDMwG5YDrlCcaLcKqOja22vKfHuhtvRpXAdgnOV2qIZOdkspF7KD/MWARsRUermGFcnBLpOgOJo09/SOx4RRz+9d5p9NNEBxkR9UPExwdE8kw==';

const publicKey = `
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3sQxyMwmDXQm3mumy345
E4NZID1guNsOYSMC7WDRbwpbCSnLDSXRZTiImdONjOTeH7UZtfF1G7YY78LrxYUS
x0dnqpAMfCgfJwt/JPMIJcfg5be2WaKMjC5uXK9Shlp9JUSFfV93YChcTkOTyv2j
CmQ+KU1P3UafpmKjCc5BwR9AIut6AGc6xtIfqb9VRa1hWGTS6XLuZQlH2Q0qYYnY
9zJVFPuBucV5t3w6brV8klpYs4OhRRKBn+2FI8bSltoreoTOdKpN5ot7mKK8uzaO
vjrHPUJbkwc0r6KUKTVqyBYz5GUAzt2ld6HYUP1g9zD6MGNOM/jEShThmDKSVm8G
DQIDAQAB
-----END PUBLIC KEY-----
`;


function verifySignature(data, signature, publicKey) {
  const verify = crypto.createVerify('RSA-SHA256');
  const parsedData = JSON.stringify(data);
  verify.update(parsedData);
  verify.end();
  return verify.verify(publicKey, signature, 'base64');
}

const result = verifySignature(data, signature, publicKey);
console.log('Is signature verified?', result);
```

```json Response Example
{"success":true}
```

# Import crypto dependency

<!-- javascript@1 -->

Start by importing Node.js's built-in crypto module.

# Get Event Data and Signature

<!-- javascript@3-14 -->

The webhook sends a payload of event data along with a unique signature. This signature is typically found in the orbital-signature header of the request

# Get Orbital's Public Key

<!-- javascript@15-26 -->

This is the public key that corresponds to Orbital's private signing key. You'll need this to verify the signature.

# Create the verifySignature Function

<!-- javascript@28-35 -->

Create a function named verifySignature that accepts the data, signature, and public key as its arguments. Inside your function, create a verifier object using `RSA-SHA256`.  This sets the algorithm used for signing, which is similar to what Orbital uses.

# Execute verification function

<!-- javascript@36-37 -->

Finally, run the verification to check the signature against the data and public key. This method returns **true** if the signature is valid and **false** if it is not.