Webhook Signature Examples
Review webhook signature examples for timestamp headers, raw body text, secret selection, and digest comparison before debugging failed verification.
Use the exact signed body
Webhook verification often fails when the body text is reformatted, parsed, or reserialized before the signature check.
- Use the raw request body when the provider requires it.
- Keep timestamp and signature headers together.
- Use the provider secret for the environment that sent the event.
Compare digest format and timing
The expected digest can fail because of hex versus base64 format, wrong prefix, stale timestamp, or secret mismatch.
- Check the documented algorithm before comparing signatures.
- Confirm whether the header includes an algorithm prefix.
- Review timestamp tolerance before retrying old examples.
Reference Blocks
Use these short blocks as starting notes before opening the calculator.
Webhook note
Provider: example service Header timestamp: t=1710000000 Header signature: v1=<digest> Body: raw request text Secret: test environment secret Check: compare expected digest with header digest
Failure table
Symptom | First check Digest mismatch | raw body and secret Timestamp rejected | clock and tolerance Header missing | provider event setup Wrong prefix | algorithm/version format
Worked Examples
Pretty-printed body
The JSON body was formatted before verification.
Use the original raw body text for the digest.
Whitespace changes can change the signature input.
Wrong environment
A test event is checked with a production secret.
Use the secret that matches the sending environment.
Test and production signing secrets are usually different.
Old timestamp
A captured event is replayed after the provider tolerance window.
Expect timestamp validation to fail even if the digest matches.
Record whether the check is digest-only or full verification.
Common Mistakes
- Verifying a parsed JSON object instead of raw body text.
- Using the wrong environment secret.
- Ignoring timestamp tolerance when replaying saved examples.
When This Is Not Enough
- Provider documentation defines the canonical string and algorithm.
- Do not share real webhook secrets, signatures, or customer event bodies.
- Server middleware can change body handling before verification if configured incorrectly.