Providers each build their signing string differently — some sign only the body,
Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.
Answeringour last check, 2026-09-24
1 of 1checks answered this week
1449 msmedian answer time
$0.002listed price per call
$0.002price it asked us
Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.
Endpoint
POST https://sicher.halowerk.com/v1/webhook-signature
| Category | Everything else |
|---|---|
| Provider host | sicher.halowerk.com |
| Networks | eip155:8453 |
| Payment schemes | exact |
| Self-reported calls, 30 days | 1 from 1 payers (the provider's figure, not ours) |
Our checks, last 30 days
| Day | Result | HTTP | Asked | Time |
|---|---|---|---|---|
| 2026-09-24 | valid payment request | 402 | $0.002 | 1449 ms |
Example input (from the provider)
{
"body": {
"body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
"provider": "github",
"secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
"signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
Promised output schema (from the provider)
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"body": {
"description": "The raw request body exactly as received, not re-serialised.",
"maxLength": 200000,
"type": "string"
},
"headers": {
"description": "All request headers; the right one is picked by provider.",
"type": "object"
},
"message_id": {
"description": "Message id for schemes that sign one, e.g. Svix.",
"maxLength": 200,
"type": "string"
},
"provider": {
"description": "Which provider signed the request.",
"enum": [
"github",
"stripe",
"shopify",
"slack",
"svix",
"generic_hmac"
],
"type": "string"
},
"secret": {
"description": "The signing secret.",
"maxLength": 2000,
"minLength": 1,
"type": "string"
},
"signature": {
"description": "The signature header value. Required unless headers is given.",
"maxLength": 2000,
"type": "string"
},
"timestamp": {
"description": "Timestamp, if the provider signs one and it is not in the headers.",
"maxLength": 40,
"type": "string"
},
"tolerance_seconds": {
"default": 300,
"description": "How old a signed timestamp may be.",
"maximum": 86400,
"minimum": 1,
"type": "integer"
}
},
"required": [
"provider",
"body",
"secret"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST",
"PUT",
"PATCH"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}