{"uid":"cap_6yWWrJk1Os7ST3847_kys","slug":"sicher-webhook-signature-verifier-74a69c9d","name":"Sicher Webhook Signature Verifier","description":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.","url":"https://sicher.halowerk.com/v1/webhook-signature?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"body":{"type":"string","maxLength":200000,"description":"The raw request body exactly as received, not re-serialised."},"secret":{"type":"string","maxLength":2000,"minLength":1,"description":"The signing secret."},"headers":{"type":"object","description":"All request headers; the right one is picked by provider."},"provider":{"enum":["github","stripe","shopify","slack","svix","generic_hmac"],"type":"string","description":"Which provider signed the request."},"signature":{"type":"string","maxLength":2000,"description":"The signature header value. Required unless headers is given."},"timestamp":{"type":"string","maxLength":40,"description":"Timestamp, if the provider signs one and it is not in the headers."},"message_id":{"type":"string","maxLength":200,"description":"Message id for schemes that sign one, e.g. Svix."},"tolerance_seconds":{"type":"integer","default":300,"maximum":86400,"minimum":1,"description":"How old a signed timestamp may be."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Mm28UbwJK-j7X2tXl0g52","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a webhook payload signature against the canonical signing scheme of a named provider, using constant-time comparison, and returns the reconstructed signed string for debugging mismatches.","exampleAgentPrompt":"Check whether this incoming Stripe webhook signature is valid — here's the raw body, the Stripe-Signature header value, and our webhook signing secret — and if it fails, show me the string that was actually signed so I can figure out what went wrong.","exampleUseCases":[{"title":"Stripe webhook integrity check","prompt":"I just received a Stripe webhook and need to verify the signature before processing the payment event — can you validate it using the raw body, the Stripe-Signature header, and our webhook secret, and tell me if it's legit?"},{"title":"GitHub webhook spoofing detection","prompt":"We're getting GitHub webhook events and want to make sure none are spoofed — verify the X-Hub-Signature-256 header against our secret and the raw payload body, and show me the signed string if there's a mismatch."},{"title":"Debugging provider signature mismatch","prompt":"Our webhook handler keeps rejecting Twilio signatures even though the secret looks right — can you run the verification against the exact body and signature we received and show us what string Twilio actually signed so we can spot the bug?"}],"resultDescription":"Returns whether the signature is valid (boolean), the reconstructed string that was signed according to the named provider's specification, and diagnostic details describing why a mismatch occurred, enabling developers to debug signing order or encoding issues without guessing.","failureModes":["Unknown or unsupported provider name — endpoint cannot construct the signing string","Missing or malformed signature header — returns validation error","Incorrect secret provided — signature will not match but the signed string is still returned for debugging","Malformed request body — signing string construction fails","Timestamp outside acceptable skew window — may flag as replay attack depending on provider spec"],"whenToPreferThis":"Use this endpoint when you need provider-accurate webhook signature verification that faithfully implements the exact signing algorithm (including timestamp prepending, ID ordering, or version markers) as each provider specifies — not a generic HMAC check. It is especially valuable when debugging mismatches because it returns the reconstructed signed string, saving engineers from guessing at signing order issues.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:30:50.029Z","isFirstParty":false,"canonicalSlug":"sicher-webhook-signature-verifier-74a69c9d"}