# How GitHub Webhook Signature Verification Works in Archon

> Learn how Archon verifies GitHub webhook signatures using HMAC-SHA-256 digest and constant-time comparison for secure incoming requests.

- Repository: [Cole Medin/Archon](https://github.com/coleam00/Archon)
- Tags: how-to-guide
- Published: 2026-04-10

---

**Archon validates incoming GitHub webhooks by computing an HMAC-SHA-256 digest from the request payload and comparing it against the `X-Hub-Signature-256` header using a constant-time comparison function.**

Archon, an open-source automation framework maintained by coleam00, implements strict **GitHub webhook signature verification** to ensure that webhook events originate legitimately from GitHub and have not been tampered with in transit. This security mechanism relies on a shared secret (`WEBHOOK_SECRET`) configured by the user to cryptographically validate every incoming request before executing