Verification

Trust the payload. Prove the sender.

Anyone who finds your endpoint URL can POST to it. Signature verification is how you know a webhook actually came from the provider whose name is on it, and not from someone curling in the dark. It is the check most integrations skip, because every provider does it differently.

Presets per provider, verdicts per request

Pick your provider on an endpoint and every capture is checked against your signing secret, and the row carries a verdict, filterable like any other field: verified when the signature matches, failed when it does not, unsigned when the request carries no signature, and unverifiable when the vault cannot rule (no secret set, a scheme it does not check yet, or a body over the capture limit). Fifty-six providers are preset across nine signature families, and anything without a preset gets manual configuration with the same verdicts. Verification is part of Solo and up.

The proof lives with the payload

The schemes differ more than you would expect. Some sign the raw body and nothing else; some bind a timestamp into the signature so a captured delivery cannot be replayed at you later; some sign with a key pair and publish the public half. The vault knows which is which.

Every signature header is stored verbatim with its request: X-Hub-Signature-256, X-Shopify-Hmac-Sha256, Stripe-Signature, all of them. Turn a preset on and history verifies retroactively; the shelf you already filled becomes evidence.

  • Presets for GitHub, Shopify, Stripe, Paddle, Twilio and 51 more
  • Verified-state filters in the explorer and the API
  • Complete signature headers on every stored request, always
Every provider we speak →
github · signature check✓ verified
# the headers are already in your vault:
"X-Hub-Signature-256": "sha256=8f3a2c41d9e6…"

# HMAC-SHA256 over the raw body, exactly as sent
signed = hmac_sha256(secret, body)
assert signed == sig       # sender proven

A verdict on every row

Each captured request carries its verdict in the list, beside its delivery outcome, so a forged or unsigned request stands out before you open it. Open one and the Verification tab says what was checked: which header matched, and how far the signed timestamp was from the moment of capture.

  • verified, failed or unsigned, filterable in the explorer
  • The check runs on the raw bytes, at capture
The request list with a verified chip on every Stripe event, beside the Verification tab of a selected invoice.paid request: verified, Stripe-Signature matches, timestamp 0s from capture.

the verdict, shown with sample Stripe events

Prove every sender.

Verdicts on every row, history included. Verification starts on Solo, from $5.

Start with Solo, $5 Read the docs