← playground
Webhook Signature Workbench
Every merchant peon in a real notification pipeline signs its callback a little differently. This computes the exact same primitives — HMAC-SHA256, a secret-salted checksum, and a signed JWT — that a merchant's server would run to verify the payload came from us and wasn't tampered with in transit.
X-Signature
computing…
How the merchant verifies it
The merchant recomputes HMAC-SHA256 over the raw request body using the shared secret, then compares it to the X-Signature header in constant time — never with a plain ===, to avoid timing attacks.