Security & Webhooks
5 min read•Updated October 2026
Security, SAML SSO & HMAC Verification
Enterprise SAML 2.0 configuration, webhook HMAC signature validation, and API token management.
Topic Overview
Ensure your enterprise integrations comply with SOC 2 Type II and ISO 27001 requirements by implementing cryptographic HMAC webhook verification and SAML 2.0 Identity Provider authentication.
11. Validating Webhook HMAC-SHA256 Signatures
Every webhook payload sent by Nabik AI includes the `x-nabik-signature` header containing a SHA-256 HMAC hash calculated using your webhook secret.
javascript
import crypto from 'crypto';
function verifyWebhookSignature(payloadBody, headerSignature, webhookSecret) {
const calculatedSignature = 'sha256=' + crypto
.createHmac('sha256', webhookSecret)
.update(payloadBody)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(headerSignature),
Buffer.from(calculatedSignature)
);
}22. Configuring SAML 2.0 Single Sign-On
Connect your corporate Identity Provider (Okta, Microsoft Entra ID / Azure AD, Google Workspace) by providing your IdP Metadata XML URL and Entity ID in the Admin Console.
Was this documentation helpful?
Your feedback helps our engineering team refine API endpoints and docs.