HubSpot has shipped three different webhook signature schemes over the years, and they all use similar header names. Most of the broken HubSpot webhook validation I have seen comes from implementing v1 when HubSpot is sending v3, or hashing the wrong string. This post shows the three versions, the exact v3 verification HubSpot recommends today, and the raw-body and URL mistakes that make every request look invalid.
If you just want the short version: use v3, hash the method plus the full URI plus the raw body plus the timestamp, and reject anything older than five minutes.
Three signature versions, and which one you are getting
HubSpot did not replace its old signatures when it added new ones. An app can receive any of them depending on how the webhook was configured and how old the app is. The three schemes are not interchangeable, so the first job is knowing which one HubSpot is sending you.
v1 (X-HubSpot-Signature, no version header): a SHA-256 hash of your app client secret concatenated with the raw request body. No timestamp, so no replay protection. This is the oldest and weakest scheme.
