Persona Webhooks

When to Use This Skill

• How do I receive Persona webhooks?
• How do I verify the Persona-Signature header?
• Why is my Persona webhook signature verification failing?
• How do I handle inquiry.completed, inquiry.approved, or verification.passed events?
• How do I parse Persona's JSON:API webhook payloads?

Verification (core)

Persona has no official server-side SDK — verify the Persona-Signature header manually. It is a Stripe-style scheme (NOT Standard Webhooks): the header is t=<unix_seconds>,v1=<hex>, and v1 is an HMAC-SHA256 hex digest over `${t}.${rawBody}` keyed with the per-webhook secret (wbhsec_...). Use the raw request body — never JSON.parse first. During secret rotation the header carries two space-separated t=...,v1=... pairs; accept if any v1 matches.