Webhook security
Webhook signature debugging checklist
A focused checklist for debugging webhook signature failures without guessing at raw-body handling, header formats, or timestamp windows.
Webhook security
Check these first
- Verify the raw request body, not a parsed or reserialized JSON object.
- Confirm the provider header name and signature scheme match the provider you are testing.
- Check whether the provider includes a timestamp and replay-protection window.
- Make sure the signing secret is the endpoint secret for this webhook destination, not an account-level API key.
- Compare against a known public fixture before changing production webhook code.
Webhook security
Provider gotchas
- Stripe signatures often fail when the endpoint secret or raw body is wrong.
- Slack signatures require the versioned base string and timestamp tolerance.
- GitHub uses the X-Hub-Signature-256 header for HMAC-SHA256.
- Shopify signs the raw body and encodes the digest differently than some other providers.
Webhook security
Named outputs to inspect
- valid, reason, and matched_signature_header tell you whether verification passed and which header matched.
- checks[] explains each signature or replay step instead of a single opaque boolean.
- raw_body_hints[] points at framework-specific body-reading mistakes.
- Use RapidAPI for marketplace auth after you have a known-good debug request.