// stripesig

why is my webhook signature failing?

paste your failing webhook payload, secret, and signature header. plain-english answer in 5 seconds — why it failed, not just that it failed. stripe, github, slack, shopify. free. no signup.

check a signature → see how it works

// the diagnostic

paste it. get the actual reason.

we recompute the expected signature against your raw body + secret, compare it to what you received, and tell you what's wrong in human terms.

provider

load example:

webhook signing secret — stripe: starts with whsec_

raw request body — exactly the bytes you received, before any JSON.parse()

headers — one per line, format Name: value

// how it works

four providers. one diagnostic.

each provider signs webhooks with HMAC-SHA256 over a known input. stripesig knows all four schemes and tells you which step in the chain broke.

hmac-sha256 · hex

stripe

signs "{t}.{body}". hex-encoded as the v1 field of Stripe-Signature.

hmac-sha256 · hex

github

signs the raw body. hex-encoded in X-Hub-Signature-256 as sha256=....

hmac-sha256 · hex

slack

signs "v0:{ts}:{body}". hex-encoded in X-Slack-Signature as v0=....

hmac-sha256 · base64

shopify

signs the raw body. base64-encoded in X-Shopify-Hmac-SHA256.

// api

also a plain HTTP endpoint.

same diagnostic, callable from your terminal or your CI. returns { valid, provider, reason, hints[], details }. rate-limited 60/min/IP. free for now.

curl -X POST https://stripesig.apimesh.xyz/check
  -H "content-type: application/json"
  -d '{
    "provider": "stripe",
    "secret": "whsec_...",
    "raw_body": "{\"id\":\"evt_...\"}",
    "headers": { "stripe-signature": "t=1577836800,v1=..." }
  }'

// privacy

we don't log your secret. or your body.

each /check request is processed in-memory and discarded. CORS allows direct browser calls — your secret never leaves your machine if you call the API client-side.

// the pattern

debug webhooks the way you'd debug code: with an actual diagnostic, not a 500.

stripesig is one wedge in apimesh — single-purpose dev tools, one specific pain each. its own subdomain, its own demo, no signup wall.

// notify me

heads-up when the paid tier ships.

replay attempts, history, more providers, team views. drop your email if that sounds useful — i'll only message you when it's actually live.