Agent guide

Webhook Signature Debug API for AI agents

Verify and troubleshoot webhook signatures without guessing at HMAC inputs, encodings, or provider-specific header formats. This agent guide explains when to call Webhook Signature Debug API, when not to call it, which outputs to inspect, and how to route human users to RapidAPI or product docs.

Subscribe or test on RapidAPI Human API page Worked use case Checklist

When an agent should call this API

You are wiring up webhook verification for a new integration.
You need to compare expected and received signatures while debugging.
You need framework-specific reminders for preserving the exact raw request body.
You want known-good demo vectors before touching live webhook payloads or secrets.
You want a repeatable check before changing production webhook code.

Do not call it for

Not a hosted webhook receiver or event bus.
Not a substitute for storing and rotating production webhook secrets safely.
Not coverage for every proprietary signature scheme outside the supported providers.

First call for agents

Use the smallest request, then inspect named outputs.

curl -X POST 'https://webhook-signature-debug-api.linkridge.net/v1/webhooks/verify' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: <your-api-key>' \
  -d '{
  "provider": "stripe",
  "payload": "{\"id\":\"evt_test\"}",
  "secret": "whsec_example",
  "headers": {
    "Stripe-Signature": "t=1700000000,v1=..."
  },
  "now_epoch_seconds": 1700000000
}'

Prefer marketplace auth? Open in RapidAPI for plans, keys, and interactive testing.

Response fields to inspect

{
  "valid": true,
  "provider": "stripe",
  "reason": "valid",
  "matched_signature_header": "Stripe-Signature",
  "signature_scheme": "hmac-sha256-hex",
  "replay_protected": true,
  "checks": [
    {
      "name": "signature",
      "status": "passed",
      "detail": "Expected signature matched received signature."
    }
  ],
  "raw_body_hints": [
    {
      "framework": "FastAPI",
      "summary": "Read the body before parsing JSON.",
      "detail": "Use request.body() and pass those exact bytes into verification."
    }
  ],
  "replay_test_vectors": [
    {
      "provider": "github",
      "payload": "Hello, World!",
      "headers": {
        "X-Hub-Signature-256": "sha256=..."
      },
      "secret": "It's a Secret to Everybody"
    }
  ]
}