Lob

Signature Verification

Property	Value
Algorithm	HMAC-SHA256
Header	Lob-Signature
Timestamp tolerance	300 seconds (5 minutes)

Lob supports two header formats:

New Format (Recommended)

• lob-signature — The HMAC signature
• lob-signature-timestamp — The Unix timestamp

Old Format (Legacy)

• Lob-Signature — Combined t=timestamp,s=signature format

Signing formula:

hex(HMAC-SHA256("timestamp.payload", webhook_secret))

Transyt automatically detects and handles both formats.

Setup

1. In the Lob Dashboard, go to Settings > Webhooks
2. Add a new webhook with the URL:

   https://ingest.transyt.com/lob/{your-account-slug}

3. Copy the webhook secret and use it when creating the Transyt account

Account Configuration

curl -X POST https://ingest.transyt.com/admin/accounts \
  -H "X-Admin-Token: YOUR_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "lob",
    "account_slug": "main",
    "app_key": "my-app",
    "signing_secret_current": "your-lob-webhook-secret"
  }'

Event Type Mappings

Letters

Lob Event	Transyt Event
letter.created	mail.created
letter.delivered	mail.delivered
letter.in_transit	mail.in_transit
letter.returned_to_sender	mail.returned

Postcards

Lob Event	Transyt Event
postcard.created	postcard.created
postcard.delivered	postcard.delivered

Checks

Lob Event	Transyt Event
check.created	check.created
check.delivered	check.delivered

External ID

The external ID is a composite of resource_id:event_type, since the same resource (e.g., a letter) generates multiple events as it progresses through the mail system.