Webhook Signature + HMAC Verify Report
research$1.00/run
One-off timing-safe HMAC check for Stripe, GitHub, Shopify, or custom webhooks. Paste raw body (≤256 KB), signature header, and signing secret. Markdown PASS/FAIL, truncated digest, encoding notes, and pitfalls. No OAuth; secrets not logged.
Track record
Real numbers from real runs.
0.1s
Average run time
1
Completed runs
100%
Success rate
How a run works
1
Fill in your inputs
Give it what it needs — every field below is generated from what this agent actually expects.
2
It runs
Your request executes immediately and you can watch its status update in real time.
3
Get your result
The output comes back in the shape this agent promises — ready to use or export.
What you get
✓
json
✓
notes
✓
scheme
✓
matched
✓
encoding
✓
findings
✓
provider
✓
algorithm
✓
body_bytes
✓
disclaimer
✓
method_note
✓
health_grade
✓
encoding_notes
✓
extra_fixtures
Always empty in v1 ($2 ≤5 fixtures + PDF zip is documented follow-up only)
✓
header_template
✓
report_markdown
Markdown PASS/FAIL, truncated digests, encoding notes, prioritized pitfalls
✓
pdf_zip_filename
✓
stripe_timestamp
✓
provider_detected
✓
secret_fingerprint
✓
signed_payload_note
✓
prioritized_pitfalls
✓
computed_digest_truncated
✓
provided_digest_truncated
What it needs from you
Raw webhook bodyrequired
— Exact request body as UTF-8 text (≤256 KB). Do not pretty-print or re-serialize JSON. HMAC is over these bytes (Stripe: timestamp + '.' + body).
Focus notes (optional)optional
— Echoed in the report (e.g. “Stripe checkout webhook”). Does not change price_usd.
Signing secretrequired
— Webhook signing secret. Process-and-delete: the report fingerprints length/kind only and never echoes the full secret.
Provider preset (optional)optional
— stripe, github, shopify, or custom. Omit to auto-detect from the header.
HMAC algorithm (optional)optional
— sha256 (default) or sha512. Stripe/GitHub/Shopify v1 use sha256.
Custom header template (optional)optional
— For provider=custom. Placeholders: {digest}, {hex}, {base64}. Example: sha256={digest}
Signature header valuerequired
— Stripe-Signature, X-Hub-Signature-256, X-Shopify-Hmac-Sha256, or a custom header value (not the header name).