1. Payload
2. Signature check (HMAC)
The signature is computed over the exact text in the payload box above. If you reformatted it, paste the original raw body again: a single space changes the result.
How webhook signatures work
The sender and the receiver share a secret. For each delivery the sender computes an HMAC of the body (sometimes prefixed with a timestamp or message id) and puts it in a header. The receiver recomputes it over the raw bytes and compares the two in constant time. If they match, the request came from someone who knows the secret and the body was not modified.
| Platform | Header | Signed string |
|---|---|---|
| GitHub | X-Hub-Signature-256: sha256=<hex> | raw body |
| Slack | X-Slack-Signature: v0=<hex> + X-Slack-Request-Timestamp | v0:{ts}:{body} |
| Meta / WhatsApp | X-Hub-Signature-256: sha256=<hex> | raw body, app secret as key |
| Standard Webhooks | webhook-signature: v1,<base64> | {id}.{ts}.{body} |
| Telegram | X-Telegram-Bot-Api-Secret-Token | no HMAC: compare the secret_token you set |
| Discord | X-Signature-Ed25519 | Ed25519 over timestamp + body (public key, not HMAC) |
Read the full walkthrough in the APIs and webhooks guide.