meraki-webhooks

Cisco Meraki Webhooks

When to Use This Skill

• Setting up Cisco Meraki Dashboard webhook (HTTP server) handlers
• How do I verify Meraki webhooks? / validating the Meraki sharedSecret
• Understanding Meraki alert types and payload structure
• Handling motion_alert, settings_changed, sensor_alert, or stopped_reporting alerts
• Why is my Meraki webhook sharedSecret check failing?

Verification (core)

Meraki does NOT use an HMAC signature header and does NOT follow the Standard Webhooks spec. There is no X-*-Signature header to check. Instead, Meraki puts a plaintext sharedSecret field inside the JSON request body. You verify by comparing that field against the shared secret you configured on the HTTP server (Dashboard → Network-wide → Alerts → Webhooks / HTTP servers).

The secret is optional and travels unencrypted, so TLS (HTTPS with a CA-trusted cert — no self-signed) is the real transport protection; the sharedSecret only proves the sender knows the value you set. Parse the body, then compare timing-safe.

Branch explicitly on whether a secret is configured. With none configured, both sides coerce to '' and every request passes with no warning — a silent fail-open. Unset means TLS-only (accept, but warn); set means the payload must carry a matching sharedSecret. See references/verification.md.

Node:

const crypto = require('crypto');

let warnedNoSecretConfigured = false;

function verify(rawBody, secret) {
  let payload;
  try { payload = JSON.parse(rawBody); } catch { return false; }

  if (!secret) {
    // TLS-only mode: nothing to compare against. Accept, but say so once.
    if (!warnedNoSecretConfigured) {
      warnedNoSecretConfigured = true;
      console.warn('MERAKI_WEBHOOK_SECRET is not set: no shared-secret verification is configured.');
    }
    return true;
  }

  const received = Buffer.from(String(payload.sharedSecret ?? ''));
  const expected = Buffer.from(String(secret));
  // Different lengths can't be equal; timingSafeEqual would throw.
  return received.length === expected.length &&
    crypto.timingSafeEqual(received, expected);
}