Webhook Signature Debug API

First call

Start with a realistic request you can inspect.

curl -X POST 'https://webhook-signature-debug-api.linkridge.net/v1/webhooks/verify' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: <your-api-key>' \
  -d '{
  "provider": "stripe",
  "payload": "{\"id\":\"evt_test\"}",
  "secret": "whsec_example",
  "headers": {
    "Stripe-Signature": "t=1700000000,v1=..."
  },
  "now_epoch_seconds": 1700000000
}'

Prefer marketplace auth? Open in RapidAPI for plans, keys, and interactive testing.

Example response

{
  "valid": true,
  "provider": "stripe",
  "reason": "valid",
  "matched_signature_header": "Stripe-Signature",
  "signature_scheme": "hmac-sha256-hex",
  "replay_protected": true,
  "checks": [
    {
      "name": "signature",
      "status": "passed",
      "detail": "Expected signature matched received signature."
    }
  ],
  "raw_body_hints": [
    {
      "framework": "FastAPI",
      "summary": "Read the body before parsing JSON.",
      "detail": "Use request.body() and pass those exact bytes into verification."
    }
  ],
  "replay_test_vectors": [
    {
      "provider": "github",
      "payload": "Hello, World!",
      "headers": {
        "X-Hub-Signature-256": "sha256=..."
      },
      "secret": "It's a Secret to Everybody"
    }
  ]
}