It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Trello API: Trello webhook signatures and Python

Hi Trello,

I’m trying to write some python code inside of an AWS Lambda function to verify the webhook signature from Trello. I’ve tried to follow the directions at but I can’t seem to get this working. Here’s what I have:

import os

import hmac

import hashlib

import base64


def handler(event, context):

   header = event['headers']['x-trello-webhook']

   sha1_check = base64.b64encode(<MY_TRELLO_API_KEY_TOKEN>, event['body'] + <MY_TRELLO_CALLBACK_URL>, hashlib.sha1).digest())

My code is syntactically correct, but it’s not working. When I attempt to compare header and sha1_check, they are not equal. I confirmed this by echoing their values to the logs. The docs at say:

Each webhook trigger contains the HTTP header X-Trello-Webhook. The header is a base64 digest of an HMAC-SHA1 hash. The hashed content is the concatenation of the full request body and the callbackURL exactly as it was provided during webhook creation. The key used to sign this text is your application’s secret.

I think my code takes all of this into account.

Can you help me figure out what is wrong?




1 answer

1 accepted

1 vote
Answer accepted

SOLVED: Emailed with Bentley Cook, a Developer Advocate, and discovered that the string you pass in to generate the HMAC is not a token that has been generated, but, instead it is the OAuth application secret that you will find at the bottom of the page at


Once I used that as the secret... it worked!

bentley Atlassian Team Mar 08, 2018


Would you mind posting the final code snippet that worked? I'd like to add it to that webhooks page as an example on how you'd check signatures in Python.

I'm happy to share the code!

I also lock down the originating IP to the Trello API IPs (I can't remember where I got that code from, but it's out there on Google), I'm including that code as well:

authorized_ips = """

def is_authorized_ip(ip):
ips = set()
for x in authorized_ips.strip().split("\n"):

return ip in ips

def base64Digest(secret):
mac =['TRELLO_OAUTH_SECRET'], secret, hashlib.sha1)
return base64.b64encode(mac.digest())

def is_from_trello(hashed_header, request_body):'hashed_header: ' + hashed_header)

double_hashed_header = base64Digest(hashed_header)'double_hashed_header: ' + double_hashed_header)

double_hashed_body = base64Digest(base64Digest(request_body + os.environ['TRELLO_CALLBACK_URL']))'double_hashed_body: ' + double_hashed_body)

return hmac.compare_digest(double_hashed_header, double_hashed_body)

def handler(event, context):'got event{}'.format(event))

if not is_authorized_ip(event['requestContext']['identity']['sourceIp']):'Unauthorized IP: ' + event['requestContext']['identity']['sourceIp'])
return { 'statusCode': 403, 'body': 'IP Deny' }

if not is_from_trello(event['headers']['x-trello-webhook'], event['body']):'Invalid request signature, denying request')'Headers:' + json.dumps(event['headers']))
return { 'statusCode': 403, 'body': 'Invalid request signature' }

Like ckraft likes this

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Trello

NEW: Trello Board & Card Templates, Plus Community-Inspired Template Gallery

Hi there, Community! Jessica here from Trello Product Marketing. As we celebrate 50 million registered users, we're super excited to share several new features available in Trello now that will hel...

826 views 3 9
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you