Why does the webhook callback signing key change with every call as opposed to using mine?

I somewhat skipped the code examples and simply assumed it’s a simple comparison but what you describe and actually do makes much more sense of course. I changed the code and it works as expected now. My earlier success stemmed from internal testing where I artificially fabricated the headers, thereby cheating.

Again, thank you for the speedy reply. Everything is now fully integrated as we’d like and works as expected. 

-Andreas

P.S. For those in need of a Python way to implement the HMAC digest verification, here it is:

#

# Assuming you got headers in dict form and body as byte

#

# Get your assigned signing key

webhook_signing_key = os.getenv("WEBHOOK_SIGNING_KEY")

# Split signature header by time and signature

signature_header = headers['Calendly-Webhook-Signature'].split(',')

t = signature_header[0].split('=')[1]

signature = signature_header[1].split('=')[1]

# Construct payload to sign

payload = t + '.' + body.decode('UTF-8')

# Generate signature with secret key

hexdigest = hmac.new(webhook_signing_key.encode('UTF-8'), payload.encode('UTF-8'), hashlib.sha256).hexdigest()

# Verify signatures

if hexdigest != signature:

    raise Exception(‘Invalid Signature’)