HMAC Authentication

HMAC (hash-based message authentication code) is used to verify that a request is coming from an expected source and that the request has not been tampered with in transit. This is achieved by including both a public (key-identifier) and private key (key-secret) in each message, the latter of which is only known to the server and client.

Blowhorn webhooks pass the Business Customer API Key in the API header for use.