Week 15 Capstone - Webhook Signatures Always Fail
TaskFlow's webhook receiver rejects every signed request with 401. Align the HMAC secret so send-webhook-test succeeds.
Puzzle Overview
A stdlib Python webhook receiver runs under systemd on this host and listens on port 8080. Callers must send `X-Hub-Signature-256: sha256=<hex>` — an HMAC-SHA256 of the request body using a shared secret. Health checks work, but every signed POST from `/usr/local/bin/send-webhook-test` comes back 401.
Your job: find why signature verification fails, fix the server's shared secret configuration so it matches the sender, and leave valid signed webhooks returning HTTP 200.
Skills tested: reading systemd unit environment, HMAC-SHA256 webhook signatures, comparing client and server secrets.
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Self-paced bootcamps
- Premium puzzle library not included (5 free puzzles available)
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Full access to the puzzle library
- Lab AI Assistant
- Priority support
Just exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.