{"uid":"cap_OH97vQsMKaRA3S5V0eirL","slug":"bitbooth-webhook-signature-verify-347520d5","name":"BitBooth Webhook Signature Verify","description":"BitBooth Webhook Signature Verify: pay 0.005 USDC, verify a webhook signature against the provider's canonical HMAC scheme. Supports stripe, github, vercel, cdp, slack, and generic HMAC-SHA256. Constant-time compare, clock-skew tolerance on timestamp-bearing providers (Stripe / Slack / CDP). Stateless — caller supplies their secret in the request body, we never store it.","url":"https://app.heinrichstech.com/v1/cdp/webhook-sig-verify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["provider","payload","signature","secret"],"properties":{"secret":{"type":"string"},"payload":{"type":"string"},"provider":{"enum":["stripe","github","vercel","cdp","slack","generic"],"type":"string"},"signature":{"type":"string"},"timestamp":{"type":"string"},"toleranceSeconds":{"type":"number"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_L-lD34VJ79h0h4sbZUhSW","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a webhook signature against the provider's canonical HMAC scheme for Stripe, GitHub, Vercel, CDP, Slack, or generic HMAC-SHA256","exampleAgentPrompt":"Can you verify this incoming Stripe webhook signature — the raw payload is the JSON body I just received, the signature header is 't=1714000000,v1=abc123...', and my Stripe signing secret is 'whsec_xyz'?","exampleUseCases":[{"title":"Stripe payment webhook authenticity check","prompt":"I just received a webhook from Stripe and want to make sure it's legitimate before processing the payment — can you verify it using the raw body, the Stripe-Signature header 't=1714050000,v1=def456...', and my webhook secret 'whsec_testABC'?"},{"title":"GitHub Actions event validation","prompt":"Verify this GitHub webhook payload for me — the raw body is the JSON push event, the X-Hub-Signature-256 header is 'sha256=abc123def456', and my GitHub webhook secret is 'gh_secret_myrepo'."},{"title":"Slack event subscription verification","prompt":"I'm getting Slack events sent to my endpoint and need to confirm they're really from Slack — can you validate the signature using the raw body, the X-Slack-Signature header 'v0=abc...', the X-Slack-Request-Timestamp '1714050000', and my Slack signing secret 'slack_signing_secret_xyz'?"}],"resultDescription":"Returns a structured JSON response indicating whether the webhook signature is valid (boolean), the provider matched, and any error detail if the verification fails. Uses constant-time comparison to prevent timing attacks and applies clock-skew tolerance for timestamp-bearing providers like Stripe, Slack, and CDP.","failureModes":["Invalid or mismatched signature returns verification failed with false result","Expired timestamp (outside tolerance window) returns clock-skew error for Stripe/Slack/CDP","Unsupported provider name returns error indicating unknown scheme","Malformed or missing signature header returns parsing error","Wrong secret supplied returns signature mismatch without exposing the correct secret"],"whenToPreferThis":"Choose this endpoint when your agent needs to cryptographically verify that an incoming webhook genuinely originated from a known provider (Stripe, GitHub, Vercel, CDP, Slack) or any generic HMAC-SHA256 scheme. It is stateless, meaning your secret never persists server-side. Prefer this over rolling your own HMAC verification when you need constant-time comparison and built-in timestamp/clock-skew handling for Stripe, Slack, and CDP.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T12:44:27.044Z","isFirstParty":false,"canonicalSlug":"bitbooth-webhook-signature-verify-347520d5"}