Webhooks

Webhook signature tool

Sign a payload exactly as the platform does, or check why a delivery you're receiving fails verification. This page imports signPayload and verifyWebhook from the SDK source and runs them in your browser — nothing is sent anywhere.

Signing secret

Payload — the exact bytes you'd send

The most common cause of a mismatch

Verifying against JSON.stringify(await req.json()) instead of the raw body. Round-tripping reorders keys, drops whitespace, and rewrites 1.0 as 1 — the HMAC covers exact bytes, so any of those breaks it. Read req.text() first.

Full walkthrough on the webhooks page, including replay protection, idempotency, and the event catalog.