Inspired by this answer, I used the following Postman pre-request script to create a SHA1 hash of a request.
Note that request.data
is an implied variable and the CryptoJS
library are provided by the Postman Sandbox for pre-request scripts.
const hash = CryptoJS.HmacSHA1(request.data, 'yourSecret').toString();
pm.globals.set('hash', hash);
You can now reference the hash value as a postman global variable using {{hash}}
syntax.
Creating X-Hub-Signature Header like GitHub API Webhook Requests
My purpose in all this was to simulate the X-Hub-Signature
header provided by the GitHub Webhooks API because my web service validates all webhook payloads to match the signature. So for me to test my web service, I also needed postman to generate a valid signature header.
Here's an adaptation of the above code snippet for generating the X-Hub-Signature
request header value.
- In GitHub, I set a webhook secret for my GitHub App.

- In Postman, I created an environment and added the key=value pair
GITHUB_WEBHOOK_SECRET
with the value I specified when I created my GitHub App.

- In Postman, I used the following pre-request script. It set the computed hash as a global variable.
const hash = CryptoJS.HmacSHA1(
request.data,
pm.environment.get('GITHUB_WEBHOOK_SECRET')
).toString();
pm.globals.set('X-HUB-SIGNATURE', 'sha1=' + hash);
- In Postman, I reference the global hash variable as a header in my requests, just like the GitHub Webhooks API will.
