Skip to content

Webhook signature verification demo #455

Description

@therealjhay

ProblemWebhook docs mention signatures but there is no interactive way to verify one; WebhookTester doesn't show how to validate the HMAC client-side.

Solution

  • Add a "Verify a signature" panel in the developers page: paste payload + signature + key → compute HMAC-SHA256 and show match/mismatch.
  • Document the canonical payload format and constant-time comparison.
  • Add a dev-mode "simulate a signed webhook" button that produces a verifiable sample.
  • Add unit tests for the HMAC computation.

Acceptance Criteria

  • Correct signatures verify, tampered ones fail with a clear diff view.
  • The demo works fully client-side in dev.
  • Tests cover empty/malformed payloads.
  • npm run build passes.

Note for Contributors: Write a clear PR description. Show a valid and a tampered signature side by side.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions