Stripe
Header Stripe-Signature with timestamp t and HMAC-SHA256 v1 over {timestamp}.{raw_body}.
- Read the raw body before JSON parse.
- Extract
tandv1. - HMAC with
whsec_.... - Constant-time compare.
- Reject stale timestamps (replay window).
API security
Verify webhook signatures locally
Stripe, GitHub, and Slack all HMAC-sign payloads. Test verification in your browser — signing secrets never leave the device.
Stripe
GitHub
Slack
Webhook signature checks are a common place to leak signing secrets into random “online HMAC” sites. This guide covers how each provider signs, then how to reproduce the header privately with the Webhook HMAC Signer.
Providers
How each platform signs
GitHub
Header X-Hub-Signature-256 as sha256= plus hex HMAC-SHA256 of the raw body.
- Keep the exact delivery body.
- HMAC-SHA256 with the webhook secret.
- Compare hex digest to the header value.
Slack
Header X-Slack-Signature from base string v0:{timestamp}:{raw_body}, HMAC-SHA256, prefixed v0=.
- Also check
X-Slack-Request-Timestamp. - Reject old requests (replay protection).
- Constant-time compare of signatures.
Local test
Reproduce the header in-browser
2
Pick a preset
Stripe, GitHub, or Slack — matching that provider’s signed string.
3
Paste secret + body
Everything stays in the tab. Use a test secret, never production, if you can.
4
Generate or verify
Build the expected header, or check an incoming header against the payload.
Need audit evidence? Download a privacy receipt after the job.