What is hash field in the BigCommerce webhook?

Question

How it generate? How I can validate it?

https://developer.bigcommerce.com/api/webhooks-getting-started

{ 
  \"store_id\": 11111,  
  \"producer\": \"         


        

Answer 1

This was answered by @KarenWhite, their developer evangelist in this thread. https://support.bigcommerce.com/s/question/0D51B00004G6kJf/incoming-webhook-posts-hash-field-in-payload

It is hashed with SHA-1, but it is not signed with the client secret:

$payload['hash'] = sha1(json_encode($payload));

Additionally, the stance on webhook security is documented in the 2018 townhall https://support.bigcommerce.com/s/article/BigCommerce-Town-Hall-February-2018

Q. How can I make sure that a webhook callback is initiated by BigCommerce only, and that the data is not altered between BigCommerce and my server endpoint? Can the hash returned in the webhook payload be used to verify the request?

A. Our webhooks today contain very little information -- they only contain an I.D. to go look up additional information. You would need to be authorized to verify that I.D. against the store’s API to determine the actual information being requested. We also secure our webhooks with TLS encryption, and enable developers to add their own headers to events for additional security.