# Construct an HMAC request via Postman to send test requests to Celigo webhooks **URL:** \ **Category:** Integrator.io\ **Tags:** script, security, json, webhook\ **Created:** [November 5, 2021, 6:49pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119 "2021-11-05T18:49:16Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![kathyanaqueeman](https://sea1.discourse-cdn.com/flex001/user_avatar/connective.celigo.com/kathyanaqueeman/32/9122_2.png) [@kathyanaqueeman](https://connective.celigo.com/u/kathyanaqueeman)\ **Post date:** [November 5, 2021, 6:49pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/1 "2021-11-05T18:49:16Z")
This post covers constructing an HMAC SH256 Base 64-encoded request via Postman to send test requests to Celigo webhooks. You must use a Pre-request Script to successfully send the request. Please note that this solution is out of scope for our Support teams, and Celigo cannot assist with third-party applications and solutions. 1. [Create your webhook listener](https://docs.celigo.com/hc/en-us/articles/360015827372-Create-webhook-listeners) in integrator.io. In this example, we've made the **Key (secret)** field: secret ![5301043caa20740200000001-0fe765a1bc0b428998497d2d1ec87321.png](https://us1.discourse-cdn.com/flex001/uploads/celigo/original/2X/b/b65f96c0668e278aeae5cf5f53897346e735cdaa.png) 2. In Postman, use the following code to hash the message and encode the hash. Note that the encoding method and hash function used here is from the CryptoJS library, as the algorithm and encoding method should match what you've configured from the webhook. ``` postman.setEnvironmentVariable("hmac", CryptoJS.enc.Base64.stringify(CryptoJS.HmacSHA256(request.data, 'secret')).toString(CryptoJS.digest)); ``` The POST URL should include your export ID. For example: [https://api.integrator.io/v1/exports//data](https://api.integrator.io/v1/exports//data%C2%A0) Example Pre-request Script in Postman: ![5301043caa20740200000001-f916bdcb24a243edb6bbfbece3f2a263.png](https://us1.discourse-cdn.com/flex001/uploads/celigo/original/2X/7/7af288a9660c647fd4784cf3088bb283515f1b20.png) Example headers in Postman: ![5301043caa20740200000001-b824b5a9e0504ecc8e96eba914c11ebb.png](https://us1.discourse-cdn.com/flex001/uploads/celigo/original/2X/7/705c285943ff28ff52151d988dc1b63593c89247.png) Example test with JSON data: ![5301043caa20740200000001-159b869360a047b28f58c006670f97c2.png](https://us1.discourse-cdn.com/flex001/uploads/celigo/original/2X/0/00c0a058125f7262a49dc0e7e472ab495848e955.png) Example success message: ![5301043caa20740200000001-c4716f26470f49829bba72a8acefcb1f.png](https://us1.discourse-cdn.com/flex001/uploads/celigo/original/2X/2/222c2e709deea345d52c79bf3210b0116a0fc3ff.png) ---
**Author:** ![paulsiegerist314](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@paulsiegerist314](https://connective.celigo.com/u/paulsiegerist314)\ **Post date:** [January 28, 2022, 4:53pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/2 "2022-01-28T16:53:20Z")
Kathyana, Can you post a similar article (using postman) on the development of a token based listener verification including a complete URL that shows the location of the "token" in the body prior to the data. I am setting up a webhook as a listener for many transactions to be sent and then imported into NetSuite as they occur at the source. The source will be an http connection and the transaction queue on the http side may be set to accumulate hundreds of records before it sends via the webhook export. Thanks, Paul ---
**Author:** ![kathyanaqueeman](https://sea1.discourse-cdn.com/flex001/user_avatar/connective.celigo.com/kathyanaqueeman/32/9122_2.png) [@kathyanaqueeman](https://connective.celigo.com/u/kathyanaqueeman)\ **Post date:** [January 31, 2022, 5:02pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/3 "2022-01-31T17:02:45Z")
Hi @paulsiegerist314, I'm going to ask around to see if I can find more information for you. I also saw your post in our [community center](https://connective.celigo.com/t/sample-url-for-webhook-listener/857). I'll reach out when I have more information. Thanks for your patience, Kathyana Rule ---
**Author:** ![kathyanaqueeman](https://sea1.discourse-cdn.com/flex001/user_avatar/connective.celigo.com/kathyanaqueeman/32/9122_2.png) [@kathyanaqueeman](https://connective.celigo.com/u/kathyanaqueeman)\ **Post date:** [February 1, 2022, 5:46pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/4 "2022-02-01T17:46:06Z")
Hi @paulsiegerist314, I asked around and found these steps: 1. Generate a token and the public URL in the listener 2. Send that token to IO using the public URL in the request body. 3. Provide the JSON path from the request body in the listener so IO knows where to find the token when the webhook request comes from the source. There is no standard format for the request body. It's whatever the source system wants to send. All you have to do is send the token to one of the fields. If you don't want to deal with adding the token to the request body, you can use the secret URL authentication type. In this case, you just have to do step 1 and use the public URL to send the webhook request to IO. In terms of security, it's pretty much the same. I also saw that you received a [response to your community post](https://connective.celigo.com/t/sample-url-for-webhook-listener/857) from our CTO, Scott Henderson. Let me know if this isn't clear or you need more assistance. Thanks, Kathyana ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 6:00am UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/5 "2024-03-13T06:00:20Z")
hey i tried your example but i m getting 401 error unauthorized ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 6:00am UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/6 "2024-03-13T06:00:42Z")
Can you help me out please ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 11:04am UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/7 "2024-03-13T11:04:41Z")
Can you reply @kathyanaqueeman to me im using this fucntionality of HMAC im very new to it please help me out i treid your example but im getting 401 error ---
**Author:** ![kathyanaqueeman](https://sea1.discourse-cdn.com/flex001/user_avatar/connective.celigo.com/kathyanaqueeman/32/9122_2.png) [@kathyanaqueeman](https://connective.celigo.com/u/kathyanaqueeman)\ **Post date:** [March 13, 2024, 2:35pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/8 "2024-03-13T14:35:09Z")
Hi @kumarmouthiktumuluri, Can you give me more details about your use case? When you ask about invoking setup in Celigo, do you mean setting up the listener? Thanks, Kathyana ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 3:10pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/9 "2024-03-13T15:10:23Z")
what value u set in secret how it is being taken in postman give detail step by step im getting 401 error ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 3:16pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/10 "2024-03-13T15:16:08Z")
how it is referred in header through that script @kathyanaqueeman ---
**Author:** ![kathyanaqueeman](https://sea1.discourse-cdn.com/flex001/user_avatar/connective.celigo.com/kathyanaqueeman/32/9122_2.png) [@kathyanaqueeman](https://connective.celigo.com/u/kathyanaqueeman)\ **Post date:** [March 13, 2024, 3:27pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/11 "2024-03-13T15:27:13Z")
Hi @kumarmouthiktumuluri, I see you're getting some help from Om [in another post](https://connective.celigo.com/t/faq-which-data-should-i-encode-when-building-a-webhook-listener-hmac-authentication/1197). We'll continue to respond in that post so we don't try the same solutions multiple times. Thanks, Kathyana ---
**Author:** ![kumarmouthiktumuluri](https://avatars.discourse-cdn.com/v4/letter/k/ba8739/32.png) [@kumarmouthiktumuluri](https://connective.celigo.com/u/kumarmouthiktumuluri)\ **Post date:** [March 13, 2024, 3:56pm UTC](https://connective.celigo.com/t/construct-an-hmac-request-via-postman-to-send-test-requests-to-celigo-webhooks/1119/12 "2024-03-13T15:56:16Z")
IT is working fine