Verifies a signed webhook request using the provider-shared secret.
Steps:
X-Webhook-Signature: t=<unix_ts>,v1=<base64sig>
${ts}.${raw_body}
)) and compareWEBHOOK_SECRET
in your server env./webhooks/test
route) with X-Webhook-Signature: t=<ts>,v1=<base64sig>
.200
with Webhook received and verified
.The signature is computed asTry It: Avoid entering secrets in the public Try It UI; run the snippet locally instead.base64(HMAC_SHA256(secret,
))
with a ±5 minute tolerance.
Signature header in the format t=<unix_ts>,v1=<base64sig>
.
Event type (e.g., order.settled
).
Unique request id for idempotency/debugging.
Verified
The response is of type object
.