How do we make sure that webhook events are coming only from Digio. IP Whitelisting ?

How do we make sure that webhook events are coming only from Digio. IP Whitelisting ?

1 - You may allow webhooks only from below IPs:

                  Sandbox :  35.154.20.28

                  Production : 13.126.198.236


2 - Provide a secret key and validate. Use X-Digio-Checksum header. 

On the client side, HmacSHA256 hex string of payload can be generated using the secret key and compared with the checksum provided in X-Digio-Checksum header. 


Check below link to calculate HmacSHA256 in your preferred coding language:
https://github.com/danharper/hmac-examples