When GoHighLevel sends an outbound webhook, your receiving server needs a way to know the request is real and not forged by a third party. GoHighLevel uses Ed25519, an elliptic-curve signature algorithm, to sign each webhook payload.
GoHighLevel signs the request body with a private key it keeps secret. It includes the signature in the request headers. Your server then verifies the signature using a public key GoHighLevel publishes. If the signature is valid, the payload is genuine. If it does not match, you reject the request.
This matters in production systems where webhook data triggers real actions: creating records, charging payments, or sending messages. Skipping signature verification means any attacker who knows your webhook URL can send fake requests and manipulate your automations.
How Ed25519 Signature works
GoHighLevel includes the signature in a header, typically X-GHL-Signature or similar. Your server reads the header, takes the raw request body, and runs the Ed25519 verification function using GoHighLevel's published public key. If verification passes, you process the request. If it fails, you return a 401 or 403.
Most server-side languages have an Ed25519 library. In Node.js you can use the built-in crypto module. In Python you can use the PyNaCl or cryptography library. The verification is a few lines of code once you have the public key.