Tools

Webhook verifier

Paste a delivery - secret, the two headers and the raw body - and see the computed signature, whether it matches and whether the timestamp is still inside the five-minute window.

Runs in your browser (WebCrypto) - nothing is sent anywhere

Delivery

Shown once when the endpoint is created (whsec_ + 40 characters). The demo value above signs the sample.
Exactly as received, e.g. t=1762853400,v1=5f1c… A second ,v1=… appears during secret rotation.
Unix seconds. Only used when the signature header has no t= part.
The exact bytes you received, not re-serialised JSON. 987 bytes (UTF-8, LF line endings).
“Generate a sample” signs the body above with the secret and fills both headers, so you see a matching pair.
Paste a signature headerwaiting
  • Header parsed: t missing, 0 v1 values
  • HMAC compare
  • Timestamp tolerance (300 s)
  • Secret does not look like whsec_ + 40 characters (still used as typed)
Signed string
—
Computed v1
—
Received v1
—
What a correct delivery carries
—

Verification steps: HMAC-SHA256 over t + "." + raw body with the endpoint secret, lowercase hex, compared in constant time with each v1; reject when t is more than 300 s from your clock. Nothing on this page leaves your browser.

#How it works

  1. The page reads t from the X-Webhook-Signature header (t=<unix seconds>,v1=<hex>).
  2. It computes HMAC-SHA256 over t + "." + raw body with your endpoint secret and hex-encodes it in lowercase.
  3. The result is compared with every v1 value in the header - one match is enough (two values appear during a secret rotation).
  4. The timestamp must be within 300 seconds of your clock; older or future deliveries should be rejected.
Raw bytes
Sign what you received, not what your JSON library prints: a re-serialised body changes whitespace and key order and the signature stops matching. The body box above keeps what you paste, with LF line endings.

Header names, retries and verification code in six languages: Webhooks reference. The example body is the trade.opened event from that page.