How does webhook signature verification work?

Webhook signature verification recomputes an HMAC-SHA256 hash over the timestamp and raw request body using your shared secret, then compares it to the signature header the sender attached — a match confirms the payload really came from that sender and was not altered in transit.

Is my signing secret sent to SkedCast’s servers?

No. The HMAC-SHA256 computation runs entirely in your browser using the Web Crypto API — the secret, body, and header you type never leave your device.

Does this match SkedCast’s real signing scheme exactly?

Yes. The signed payload construction (`" . "`, HMAC-SHA256, hex-encoded) is copied from the same module the platform’s outbound webhook dispatcher uses, and is pinned against the backend’s own test fixture so it cannot silently drift.

Why does a correct-looking signature still fail?

The most common cause is the request body not being byte-for-byte identical to what was signed — re-serializing JSON, changing whitespace, or trimming a trailing newline all change the signature.

What does the timestamp freshness check protect against?

It prevents a captured, valid delivery from being replayed later — SkedCast’s own verifier rejects a timestamp more than 5 minutes old or in the future, and this tool applies the same window.

What is the difference between this and Standard Webhooks?

SkedCast also emits Standard Webhooks-format signatures alongside the `X-SkedCast-Signature` header; this tool tests the `X-SkedCast-Signature` scheme specifically, which is the Stripe-style format most integrators already recognize.

Can I use this to sign requests for a different platform?

The underlying HMAC-SHA256 math is generic, but the exact header format and signed-payload construction here matches SkedCast’s scheme specifically — another platform’s scheme may differ.

Free tool

Webhook signature verification tester

This tool tests webhook signature verification by checking or generating an `X-SkedCast-Signature` header against the EXACT HMAC-SHA256 scheme SkedCast’s own webhooks are signed with (`t=<seconds>,v1=<hex HMAC>` over `"<t>.<rawBody>"`) — the same construction the platform’s dispatch code uses, so a passing result here means your receiver logic is genuinely compatible. Everything runs in your browser via the Web Crypto API; your signing secret is never sent anywhere.

Test webhook signature verification

Signing secret

Never uploaded — the HMAC is computed with your browser’s Web Crypto API.

Request body (exact bytes SkedCast sent — or will send)

X-SkedCast-Signature header value

How to verify or generate a webhook signature

Choose Verify or Generate. Verify checks a signature you already received; Generate produces a test signature so you can check your own receiver code.
Paste your signing secret. Use the secret shown once when you registered the webhook endpoint (or rotated its secret) in SkedCast.
Paste the exact request body. This must be the exact raw bytes that were sent — re-serializing JSON with different key order or whitespace changes the signature.
Verify or generate. For Verify, also paste the X-SkedCast-Signature header value you received; for Generate, click Generate header to get a test value.

Worked examples

Debugging a receiver that rejects every delivery

Paste the secret, the raw body from a failed delivery’s log, and a header like t=1750000000,v1=e0b51d5... that SkedCast sent — if this tool says the signature is valid, the bug is in your receiver’s own verification code, not in what SkedCast sent.

Testing a new receiver before going live

Use Generate with your real secret and a sample JSON body like {"id":"evt_1"} to produce a valid header, then send that exact body and header to your own endpoint locally to confirm your verification code accepts it.

Webhook signature verification FAQ

Related reading: the webhook glossary entry explains what a webhook is, the webhook examples page shows real payloads, the API & webhooks feature page covers the product surface, and Webhooks: every event, signed and delivered is the full developer guide.

How does webhook signature verification work?: Webhook signature verification recomputes an HMAC-SHA256 hash over the timestamp and raw request body using your shared secret, then compares it to the signature header the sender attached — a match confirms the payload really came from that sender and was not altered in transit.
Is my signing secret sent to SkedCast’s servers?: No. The HMAC-SHA256 computation runs entirely in your browser using the Web Crypto API — the secret, body, and header you type never leave your device.
Does this match SkedCast’s real signing scheme exactly?: Yes. The signed payload construction (`"<timestamp>.<rawBody>"`, HMAC-SHA256, hex-encoded) is copied from the same module the platform’s outbound webhook dispatcher uses, and is pinned against the backend’s own test fixture so it cannot silently drift.
Why does a correct-looking signature still fail?: The most common cause is the request body not being byte-for-byte identical to what was signed — re-serializing JSON, changing whitespace, or trimming a trailing newline all change the signature.
What does the timestamp freshness check protect against?: It prevents a captured, valid delivery from being replayed later — SkedCast’s own verifier rejects a timestamp more than 5 minutes old or in the future, and this tool applies the same window.
What is the difference between this and Standard Webhooks?: SkedCast also emits Standard Webhooks-format signatures alongside the `X-SkedCast-Signature` header; this tool tests the `X-SkedCast-Signature` scheme specifically, which is the Stripe-style format most integrators already recognize.
Can I use this to sign requests for a different platform?: The underlying HMAC-SHA256 math is generic, but the exact header format and signed-payload construction here matches SkedCast’s scheme specifically — another platform’s scheme may differ.

Ready to broadcast everywhere?

Sign up free — no credit card. You land on the Free plan, and you can start a one-time 7-day Studio trial from your workspace whenever you are ready. Connect your first accounts, import a batch, and watch one post fan out across every platform.

Start free Log in to your console