ProblemWebhook docs mention signatures but there is no interactive way to verify one; WebhookTester doesn't show how to validate the HMAC client-side.
Solution
- Add a "Verify a signature" panel in the developers page: paste payload + signature + key → compute HMAC-SHA256 and show match/mismatch.
- Document the canonical payload format and constant-time comparison.
- Add a dev-mode "simulate a signed webhook" button that produces a verifiable sample.
- Add unit tests for the HMAC computation.
Acceptance Criteria
- Correct signatures verify, tampered ones fail with a clear diff view.
- The demo works fully client-side in dev.
- Tests cover empty/malformed payloads.
npm run build passes.
Note for Contributors: Write a clear PR description. Show a valid and a tampered signature side by side.
ProblemWebhook docs mention signatures but there is no interactive way to verify one;
WebhookTesterdoesn't show how to validate the HMAC client-side.Solution
Acceptance Criteria
npm run buildpasses.Note for Contributors: Write a clear PR description. Show a valid and a tampered signature side by side.