Webhook security

Debug webhook signature verification

Verify and troubleshoot webhook signatures without guessing at HMAC inputs, encodings, or provider-specific header formats.

View API details Open in RapidAPI

Problem

Webhook signature failures rarely explain themselves.

Webhook providers usually give you a header, a payload, and a secret. When verification fails, the hard part is figuring out whether the mismatch came from encoding, payload mutation, timestamp handling, or the wrong signature format.

When to use it

  • You are wiring up webhook verification for a new integration.
  • You need to compare expected and received signatures while debugging.
  • You want a repeatable check before changing production webhook code.

First call

Run a small request and inspect the response.

curl -X POST 'https://webhook-signature-debug-api.linkridge.net/v1/webhooks/verify' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: <your-api-key>' \
  -d '{
  "provider": "stripe",
  "payload": "{\"id\":\"evt_test\"}",
  "secret": "whsec_example",
  "headers": {
    "Stripe-Signature": "t=1700000000,v1=..."
  },
  "now_epoch_seconds": 1700000000
}'

Use RapidAPI for marketplace auth, plans, and interactive testing.

Example response

{
  "valid": true,
  "provider": "stripe",
  "reason": "valid",
  "matched_signature_header": "Stripe-Signature",
  "signature_scheme": "hmac-sha256-hex",
  "replay_protected": true,
  "checks": [
    {
      "name": "signature",
      "status": "passed",
      "detail": "Expected signature matched received signature."
    }
  ]
}

Based on