diff --git a/apps/docs/integrations/webhooks.mdx b/apps/docs/integrations/webhooks.mdx
index bfbd247..33fd1b3 100644
--- a/apps/docs/integrations/webhooks.mdx
+++ b/apps/docs/integrations/webhooks.mdx
@@ -33,10 +33,10 @@ osforms sends a `POST` request with `Content-Type: application/json`:
 
 ## Verifying signatures
 
-Every request includes an `X-osforms-Signature-256` header:
+Every request includes an `X-osforms-Signature` header:
 
 ```
-X-osforms-Signature-256: sha256=<hex>
+X-osforms-Signature: <hex>
 ```
 
 The signature is computed as `HMAC-SHA256(requestBody, signingSecret)` where `requestBody` is the raw JSON string.
@@ -51,16 +51,17 @@ function verifySignature(
   signature: string,
   secret: string
 ): boolean {
-  const expected =
-    'sha256=' +
-    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
+  const expected = crypto
+    .createHmac('sha256', secret)
+    .update(rawBody)
+    .digest('hex');
 
-  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
 }
 
 // Express example
 app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
-  const sig = req.headers['x-osforms-signature-256'] as string;
+  const sig = req.headers['x-osforms-signature'] as string;
   if (!verifySignature(req.body.toString(), sig, process.env.WEBHOOK_SECRET!)) {
     return res.status(401).json({ error: 'Invalid signature' });
   }