Webhook Signature Verifier

Accept a raw payload, secret, signature header value, and algorithm. Computes the expected HMAC (Stripe/GitHub sha256= hex style) and returns whether it matches using a timing-safe compare.

FeaturesCopy Anchor Link

• POST /verify - HMAC-SHA256 verification with clear comparison explanation
• Supports prefixed signatures (sha256=...) and raw hex
• Uses Web Crypto at the edge; no external libraries

API ReferenceCopy Anchor Link

POST /verifyCopy Anchor Link

payload string (required) - Raw request body as received.

secret string (required) - Shared signing secret.

signature string (required) - Signature from the webhook header.

algorithm string (optional) - Default sha256.

Example RequestCopy Anchor Link

curl -X POST "https://your-worker.workers.dev/verify" \
  -H "Content-Type: application/json" \
  -d '{"payload":"{\"id\":1}","secret":"whsec_test","signature":"sha256=..."}'

Success ResponseCopy Anchor Link

{
  "match": true,
  "algorithm": "sha256",
  "expectedSignature": "sha256=...",
  "providedSignature": "sha256=...",
  "explanation": "Timing-safe comparison of 32-byte HMAC digests returned match."
}

Error CodesCopy Anchor Link

• 400 - INVALID_BODY, MISSING_FIELD, INVALID_ALGORITHM

Use CasesCopy Anchor Link

• Debug Stripe, GitHub, or Shopify webhook signature mismatches
• Learn timing-safe HMAC verification patterns for Workers
• Validate signing logic before wiring production webhook handlers

LimitationsCopy Anchor Link

• HMAC-SHA256 only in this experiment
• Secrets are sent in the request body; use only for debugging, not production traffic
• No replay protection or timestamp validation

Use in your projectCopy Anchor Link

/** Allowed URL schemes for optional webhook URL validation helpers. */export const ALLOWED_SCHEMES = ["http:", "https:"] as const;/** * Validates and normalizes a URL. */export function validateUrl(input: string | undefined): string | null {  if (!input || typeof input !== "string") return null;  const trimmed = input.trim();  if (!trimmed) return null;  try {    const url = new URL(trimmed);    if (!ALLOWED_SCHEMES.includes(url.protocol as (typeof ALLOWED_SCHEMES)[number])) {      return null;    }    return url.href;  } catch {    return null;  }}

DeploymentCopy Anchor Link

Local DevelopmentCopy Anchor Link

cd apps/experiments/webhook-signature-verifier
npm install
npm run dev

ConfigurationCopy Anchor Link

No bindings required beyond the Workers runtime.

Cloudflare Features UsedCopy Anchor Link

• Workers
• Web Crypto