What is the Alchemy signature and where to find the auth token?
Last updated: October 9, 2026
Alchemy signs every webhook request so you can verify it actually came from Alchemy and not from a malicious source. Here's how to find your webhook's signing key and use it to verify incoming requests.
What is the X-Alchemy-Signature header?
Every webhook request Alchemy sends includes an X-Alchemy-Signature header. This header carries an HMAC SHA-256 signature computed from the raw request body using your webhook's signing key. You compute the same HMAC on your end and compare it to the header value to confirm the request came from Alchemy.
Where do I find my webhook's signing key?
Log in to your Alchemy Dashboard.
Open the Webhooks section.
Select the specific webhook you created.
On the webhook's detail page, look to the top right for Signing Key, then click to reveal and copy it.
How do I verify a webhook request?
Compute an HMAC SHA-256 digest of the raw request body using your signing key.
Compare your computed digest to the value in the
X-Alchemy-Signatureheader.If they match, the request is authentic. If they don't match, reject the request.
Optional: allowlist Alchemy's source IPs
Alchemy doesn't use public-key (asymmetric) verification for webhooks. As an extra layer of security on top of signature verification, you can allowlist the IP addresses Alchemy sends webhooks from: 54.236.136.17 and 34.237.24.169.