{"slug":"sicher-halowerk-com-v1-webhook-signature-66cb7d","title":"Providers each build their signing string differently — some sign only the body,","host":"sicher.halowerk.com","method":"POST","resource":"https://sicher.halowerk.com/v1/webhook-signature","category":"other","description":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually","price_listed":0.002,"price_asked":0.002,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":1449,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"body":"{\"synthetic\":true,\"event\":\"documentation-example\"}","provider":"github","secret":"HALOWERK-public-synthetic-example-never-use-for-authentication","signature":"sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"body":{"description":"The raw request body exactly as received, not re-serialised.","maxLength":200000,"type":"string"},"headers":{"description":"All request headers; the right one is picked by provider.","type":"object"},"message_id":{"description":"Message id for schemes that sign one, e.g. Svix.","maxLength":200,"type":"string"},"provider":{"description":"Which provider signed the request.","enum":["github","stripe","shopify","slack","svix","generic_hmac"],"type":"string"},"secret":{"description":"The signing secret.","maxLength":2000,"minLength":1,"type":"string"},"signature":{"description":"The signature header value. Required unless headers is given.","maxLength":2000,"type":"string"},"timestamp":{"description":"Timestamp, if the provider signs one and it is not in the headers.","maxLength":40,"type":"string"},"tolerance_seconds":{"default":300,"description":"How old a signed timestamp may be.","maximum":86400,"minimum":1,"type":"integer"}},"required":["provider","body","secret"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-09-24","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.002,"price_match":true,"latency_ms":1449,"error":null}],"description_full":"Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.","last_updated":"2026-09-19T16:02:34.068Z","schemes":["exact"]}