> ## Documentation Index
> Fetch the complete documentation index at: https://devs.elementpay.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Test webhook signature verification

> Verifies a signed webhook request using the provider-shared secret.

Steps:
1) Read raw body
2) Parse `X-Webhook-Signature: t=<unix_ts>,v1=<base64sig>`
3) Enforce ±5 minute tolerance
4) Recompute base64(HMAC_SHA256(secret, `${ts}.${raw_body}`)) and compare
5) If valid, return 200 with echo metadata

**How to test (recommended, no secrets in the docs UI)**

1. Set `WEBHOOK_SECRET` in your server env.
2. Use one of the client snippets below to sign and POST a JSON payload to **your** webhook endpoint (or to this `/webhooks/test` route) with `X-Webhook-Signature: t=<ts>,v1=<base64sig>`.
3. Expect `200` with `Webhook received and verified`.

> The signature is computed as `base64(HMAC_SHA256(secret, `${ts}.${raw_body}`))` with a ±5 minute tolerance.

**Try It**: Avoid entering secrets in the public Try It UI; run the snippet locally instead.


## OpenAPI

````yaml api-reference/openapi.json post /webhooks/test
openapi: 3.1.0
info:
  title: Element Aggregator API for B2B
  description: >-
    The Element Aggregator acts as a bridge between fiat and blockchain smart
    contracts. It handles payment processing, event listening, and order
    management, ensuring seamless coordination between Web2 and Web3 ecosystems.
  version: 1.0.0
servers:
  - url: https://sandbox.elementpay.net
security: []
paths:
  /webhooks/test:
    post:
      tags:
        - Webhooks
      summary: Test webhook signature verification
      description: >-
        Verifies a signed webhook request using the provider-shared secret.


        Steps:

        1) Read raw body

        2) Parse `X-Webhook-Signature: t=<unix_ts>,v1=<base64sig>`

        3) Enforce ±5 minute tolerance

        4) Recompute base64(HMAC_SHA256(secret, `${ts}.${raw_body}`)) and
        compare

        5) If valid, return 200 with echo metadata
      operationId: webhooks_test
      parameters:
        - name: X-Webhook-Signature
          in: header
          required: true
          description: Signature header in the format `t=<unix_ts>,v1=<base64sig>`.
          schema:
            type: string
          examples:
            example:
              summary: Valid signature header
              value: t=1716384000,v1=6n3K0F...==
        - name: X-Webhook-Event
          in: header
          required: false
          description: Event type (e.g., `order.settled`).
          schema:
            type: string
        - name: X-Webhook-Id
          in: header
          required: false
          description: Unique request id for idempotency/debugging.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
            example:
              ping: pong
      responses:
        '200':
          description: Verified
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: success
                  message:
                    type: string
                    example: Webhook received and verified
                  data:
                    type: object
                    properties:
                      event:
                        type: string
                        nullable: true
                      request_id:
                        type: string
                        nullable: true
              example:
                status: success
                message: Webhook received and verified
                data:
                  event: order.settled
                  request_id: e1a9...
        '400':
          description: Bad request
          content:
            application/json:
              examples:
                invalid_json:
                  summary: Invalid JSON body
                  value:
                    status: error
                    message: Invalid JSON payload
                    data: null
        '401':
          description: Signature errors
          content:
            application/json:
              examples:
                missing_header:
                  summary: No signature header
                  value:
                    status: error
                    message: Missing X-Webhook-Signature
                    data: null
                malformed_header:
                  summary: Bad header format
                  value:
                    status: error
                    message: Malformed signature header (expected t=...,v1=...)
                    data: null
                invalid_timestamp:
                  summary: t not an integer
                  value:
                    status: error
                    message: Invalid timestamp in signature header
                    data: null
                outside_window:
                  summary: Timestamp outside tolerance
                  value:
                    status: error
                    message: Signature timestamp outside tolerance window
                    data: null
                bad_signature:
                  summary: Signature mismatch
                  value:
                    status: error
                    message: Invalid webhook signature
                    data: null
        '500':
          description: Server misconfiguration
          content:
            application/json:
              example:
                status: error
                message: 'Server misconfigured: WEBHOOK_SECRET missing'
                data: null
      security: []

````