Test webhook signature verification
Webhooks
Test webhook signature verification
Verifies a signed webhook request using the provider-shared secret.
Steps:
- Read raw body
- Parse
X-Webhook-Signature: t=<unix_ts>,v1=<base64sig> - Enforce ±5 minute tolerance
- Recompute base64(HMAC_SHA256(secret,
${ts}.${raw_body})) and compare - If valid, return 200 with echo metadata
POST
Test webhook signature verification
How to test (recommended, no secrets in the docs UI)
- Set
WEBHOOK_SECRETin your server env. - Use one of the client snippets below to sign and POST a JSON payload to your webhook endpoint (or to this
/webhooks/testroute) withX-Webhook-Signature: t=<ts>,v1=<base64sig>. - Expect
200withWebhook received and verified.
The signature is computed asTry It: Avoid entering secrets in the public Try It UI; run the snippet locally instead.base64(HMAC_SHA256(secret,))with a ±5 minute tolerance.
Headers
Signature header in the format t=<unix_ts>,v1=<base64sig>.
Event type (e.g., order.settled).
Unique request id for idempotency/debugging.
Body
application/json
The body is of type object.

