Webhook security
Webhook signature debugging checklist
A focused checklist for debugging webhook signature failures without guessing at raw-body handling, header formats, or timestamp windows.
Webhook security
Check these first
- Verify the raw request body, not a parsed or reserialized JSON object.
- Confirm the provider header name and signature scheme match the provider you are testing.
- Check whether the provider includes a timestamp and replay-protection window.
- Make sure the signing secret is the endpoint secret for this webhook destination, not an account-level API key.
- Compare against a known public fixture before changing production webhook code.
Webhook security
Provider gotchas
- Stripe signatures often fail when the endpoint secret or raw body is wrong.
- Slack signatures require the versioned base string and timestamp tolerance.
- GitHub uses the X-Hub-Signature-256 header for HMAC-SHA256.
- Shopify signs the raw body and encodes the digest differently than some other providers.
Next step
- Try the related API when this checklist turns into a concrete test: Webhook Signature Debug API.
- Use the checklist as a review aid before changing production code, publishing a marketplace listing, or copying logic into another workflow.