---
title: "Webhook Security for Insurance Integrations: HMAC Signing, Replay Protection, and Why It's Non-Negotiable"
description: "Insurance webhooks carry PII. If your CRM's webhooks aren't signed, you're one leaked URL away from a breach. Here's the playbook unLocked uses and what to demand from any vendor."
url: https://unlockedcrm.ai/blog/webhook-security-insurance-hmac-best-practices
canonical: https://unlockedcrm.ai/blog/webhook-security-insurance-hmac-best-practices
category: "Engineering"
published: 2026-07-30
updated: 2026-07-30
author: "unLocked Team"
source: unLocked CRM — AI CRM for insurance agents
---

# Webhook Security for Insurance Integrations: HMAC Signing, Replay Protection, and Why It's Non-Negotiable

<p>Webhooks are the most overlooked attack surface in CRM integrations. The URL is public by necessity, the payload often contains PII, and most receivers blindly trust whatever arrives. That's a breach waiting to happen.</p>

<h2>The Three Layers of Protection</h2>
<h3>1. HMAC-SHA256 Signing</h3>
<p>Every payload includes a header like <code>X-Signature: t=1714000000,v1=&lt;hex&gt;</code>. Your endpoint computes <code>HMAC-SHA256(timestamp + "." + raw_body, shared_secret)</code> and constant-time compares. Forgery requires the secret.</p>

<h3>2. Timestamp Freshness</h3>
<p>Reject requests where the timestamp is more than 5 minutes old. This blocks replay attacks even if a payload is captured in transit.</p>

<h3>3. Per-Subscription Secrets</h3>
<p>Each webhook subscription has its own rotatable secret. Rotate immediately if any system that knew the secret is decommissioned.</p>

<h2>What to Demand From Any CRM Vendor</h2>
<ul>
<li>Stripe-style HMAC signatures (or equivalent)</li>
<li>Documented timestamp tolerance and replay protection</li>
<li>Per-subscription secrets, dashboard-rotatable</li>
<li>Retry ladder with dead-letter queue and dashboard replay</li>
<li>Test/inspect tooling so you can verify signatures during development</li>
</ul>

<h2>The Compliance Angle</h2>
<p>Under HIPAA and most state insurance privacy regimes, "reasonable security" is the standard. Unsigned webhooks carrying PII fail that test in any post-incident review.</p>

---

Source: [Webhook Security for Insurance Integrations: HMAC Signing, Replay Protection, and Why It's Non-Negotiable](https://unlockedcrm.ai/blog/webhook-security-insurance-hmac-best-practices) — unLocked CRM, the AI CRM built for insurance agents. Citation permitted with attribution and a link to https://unlockedcrm.ai/blog/webhook-security-insurance-hmac-best-practices.