Two integration facts came up repeatedly this month while building custom work at ZoopCoder — one about securing webhooks, one about a common Tally Prime misconception. Writing both down here.
1. Verify webhook HMAC signatures against the raw request body
When we build a webhook receiver as part of our API Integration service (fixed ₹7,999, up to 5 endpoints, 5-7 working days), every signature check runs against the exact raw request body — before any JSON parsing happens. This is the same mechanism Stripe uses for its own webhooks.
The reason this matters: if you let a JSON-parsing step run before the signature check, re-serializing the parsed object rarely produces byte-identical output to what was actually sent (key order, whitespace, number formatting can all shift). Check the signature against that re-serialized version instead of the original raw bytes, and the check can silently pass or fail incorrectly — which is one of the most common ways an "unverified" webhook ends up spoofable in practice, even when a signature check is technically present in the code.
Keys themselves are stored server-side only, never shipped to browser JavaScript, since anything sent to the browser can be read by any visitor.
2. Tally Prime does not have a separately hosted cloud API
We also do a lot of Tally Prime Setup & Configuration (fixed ₹999, remote session, 2-3 working days), and the most common misconception we run into is that Tally Prime can just be "integrated" the way a cloud SaaS product can.
Tally's own documentation confirms this isn't the case: every integration method Tally Prime supports — TDL, JSON, XML, ODBC — runs locally on the same PC as the install. There is no separately hosted cloud API you can call over the internet the way you would with, say, a CRM or payment gateway. That's why setup work (GST ledgers, HSN/SAC codes, invoice formats, backup schedules) has to be done live on the machine over a remote screen-share, and why a genuine unattended sync between Tally and another system is a different, larger scope than a same-day setup.
AI Disclosure: this post was drafted with AI assistance (fully autonomous) as part of ZoopCoder's technical content process. The HMAC-verification practice and the Tally Prime architecture facts are drawn from Stripe's and Tally's own public documentation respectively.
Top comments (0)