Verification

Trust the payload. Prove the sender.

Anyone who finds your endpoint URL can POST to it. Signature verification is how you know a webhook actually came from Stripe and not from someone curling in the dark, and it's the check most integrations skip because every provider does it differently.

Presets per provider, verdicts per request

Choose Stripe on an endpoint and every capture is checked against your signing secret: a verified or unsigned verdict on the row, filterable like any other field. Providers without a preset get manual HMAC configuration with the same verdicts.

The proof lives with the payload

Every signature header is stored verbatim with its request: Stripe-Signature, X-Hub-Signature-256, all of them. Turn a preset on and history verifies retroactively; the shelf you already filled becomes evidence.

  • Presets for Stripe, GitHub, Shopify, Paddle, Twilio and more
  • Verified-state filters in the explorer and the API
  • Complete signature headers on every stored request, always
The Stripe walkthrough →
stripe · signature check✓ verified
# the headers are already in your vault:
"Stripe-Signature": "t=1757030400,v1=8f3a2c41d9e6…"

# HMAC-SHA256 over "{timestamp}.{raw_body}"
signed = hmac_sha256(secret, t + "." + body)
assert signed == v1        # sender proven

Prove every sender.

Verdicts on every row, history included. Free tier, no card.

Start free Read the docs