Postback signature tool

How the signature works

1. Take the unix timestamp in seconds. Send it as x-ea-timestamp.
2. Build the signed string: the timestamp, a literal dot, then the raw body exactly as you will send it.
3. HMAC-SHA256 that string with your surface postback secret.
4. Hex encode the digest and prefix it with sha256=. Send it as x-ea-signature.
5. Send x-ea-surface alongside so the server knows which secret to check against.

The full request and response contract is in the OpenAPI document, and the server postback guide walks through a first conversion end to end.

Questions

Why does my signature not match even though the values look right?

Almost always because the body was re-serialized. The server signs the raw request bytes, so if you parse the JSON and stringify it again, a changed key order or a difference in whitespace produces different bytes and a different signature. Sign and send the exact same string.

What exactly is signed?

The timestamp, then a literal dot, then the raw body: HMAC-SHA256 over `<timestamp>.<rawBody>` using your surface postback secret. The result is sent hex encoded with a sha256= prefix in the x-ea-signature header.

Why was my request rejected with a valid signature?

The server also enforces a 300 second clock-skew window on x-ea-timestamp. A signature computed with an old timestamp stays valid forever otherwise, so replays would be possible. Generate the timestamp at send time and check the sending machine's clock.

Is my postback secret sent anywhere by this page?

No. The HMAC is computed in your browser with the Web Crypto API. There is no network request, no logging, and no server involved in producing the signature. You can confirm this in your browser's network tab.

Where do I find my surface postback secret?

In the dashboard under Integrations. Each surface has its own secret, and the same page shows the postback URL to send conversions to.