Web3 · hard

39. Verifying Blockchain Webhooks

Securely receiving on-chain event notifications.

Services like Alchemy, Moralis, or QuickNode send webhooks to Laravel routes when on-chain events occur, and these payloads must be verified (typically via an HMAC signature header) before being trusted. A dedicated controller endpoint should be excluded from CSRF verification (since it's an external POST) but still validate the signature and reject unauthorized requests early. Idempotency keys or transaction hashes should be checked to avoid processing the same webhook twice.

Check your understanding

1. Why must blockchain webhook payloads be signature-verified?
They're always encryptedTo ensure the request truly came from the trusted provider and wasn't forgedTo speed up the responseLaravel requires it for all POST routes
2. What should be excluded for external webhook routes but not skip signature checks?
Authentication middlewareCSRF verificationRate limiting entirelyLogging