{"uid":"cap_WcKACCnEntvhtba8A3WSC","slug":"agent402-webhook-hmac-signature-verifier-86c7d7a4","name":"Agent402 Webhook HMAC Signature Verifier","description":"Verify a webhook's HMAC signature against the correct per-provider scheme: GitHub (X-Hub-Signature-256, sha256=hex), Stripe (Stripe-Signature t/v1 over \".\" with replay tolerance), Shopify (X-Shopify-Hmac-Sha256, base64), Slack (X-Slack-Signature, v0:: with replay tolerance). Constant-time comparison; the secret is never echoed. Pass the RAW request body string - signatures are over the raw bytes. Deterministic.","url":"https://agent402.tools/api/webhook-verify","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"secret":{"type":"string","description":"the provider signing secret (never echoed back)"},"payload":{"type":"string","description":"the RAW request body string, byte-for-byte as received (never a re-serialized object)"},"provider":{"type":"string","description":"github | stripe | shopify | slack"},"signature":{"type":"string","description":"the signature header value, with or without its scheme prefix (sha256= / v0= / t=...,v1=...)"},"timestamp":{"type":"string","description":"provider timestamp, required for stripe + slack (stripe may be parsed from a t= element in the signature)"},"toleranceSeconds":{"type":"number","description":"max timestamp age for stripe/slack replay protection (default 300; 0 skips the age check)"}}},"responseSchema":{"type":"json","example":{"valid":true,"reason":"signature matches the recomputed HMAC for this payload and secret","scheme":"X-Hub-Signature-256: sha256=hex(HMAC-SHA256(secret, rawBody))","provider":"github"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HFBAdC6i5kleZHl-hi_gT","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies webhook HMAC signatures for GitHub, Stripe, Shopify, and Slack using each provider's exact signing scheme, including replay protection.","exampleAgentPrompt":"Can you verify this incoming Stripe webhook for me? The raw body is '{\"id\":\"evt_123\",\"type\":\"payment_intent.succeeded\"}', the Stripe-Signature header is 't=1714000000,v1=abc123def456', my webhook secret is 'whsec_mysecretkey', and the timestamp is '1714000000' — use a 300-second replay tolerance.","exampleUseCases":null,"resultDescription":"Returns whether the HMAC signature is valid or invalid for the given provider's scheme, incorporating timestamp-based replay protection for Stripe and Slack. The signing secret is never echoed back in the response.","failureModes":["Invalid or mismatched signature returns a failed verification result","Timestamp outside tolerance window triggers replay protection failure for Stripe/Slack","Missing required timestamp for Stripe or Slack causes error","Unknown provider value returns an error indicating unsupported provider","Malformed signature header format causes parsing error","Raw body was re-serialized (not byte-for-byte original) leading to false negative"],"whenToPreferThis":"Use this endpoint when you need to cryptographically verify that an incoming webhook genuinely originated from GitHub, Stripe, Shopify, or Slack — especially when you want to avoid implementing each provider's specific HMAC scheme (sha256 hex for GitHub, timestamped HMAC for Stripe, base64 HMAC for Shopify, v0= scheme for Slack) and replay-attack protection yourself.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T07:03:37.912Z","isFirstParty":false}