Webhook Signature Checker

Overview

You send the raw webhook body, the provider's signature header, your shared secret, and a reference time — and we tell you whether the signature matches and whether the timestamp is still fresh. We support common provider schemes (Stripe, GitHub, Shopify, Slack, Svix, and a generic HMAC mode). An invalid signature returns valid=false with a reason — not a platform error. Your secret never appears in the response. We perform no network calls. Don't use this to fetch URLs or verify a bare HMAC without a provider header format.

Webhook authentication fails quietly when the signed-payload construction or timestamp check is wrong. You shouldn't have to reimplement every provider's header format.

When to use it

Scope

Non-goals

• Does not open sockets or make HTTP requests
• Does not store, retrieve, or rotate secrets
• Does not manage idempotency keys or replay caches
• Does not contact provider APIs
• Does not support schemes outside the declared list

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"network.validate_webhook_signature","input":{"scheme":"github_sha256","body":"{}","signatureHeader":"sha256=abc","secret":"s","referenceTime":"2026-03-25T00:00:00Z"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("network.validate_webhook_signature", {"referenceTime":"2026-03-25T00:00:05Z","signatureHeader":"t=1774396800,v1=8d062b986658ceb065e80ea46c6432744f86163bdc9b3afb11cfa8929c2011a4","body":"{\"id\":\"evt_1\",\"type\":\"charge.succeeded\"}","secret":"whsec_dGVzdF9zZWNyZXRfa2V5XzEyMzQ1Njc4OTAxMjM0NTY=","scheme":"stripe_v1"});

Errors

Other limits

Limitations

• Does not open sockets or make HTTP requests
• Does not store, retrieve, or rotate secrets
• Does not manage idempotency keys or replay caches
• Does not contact provider APIs
• Does not support schemes outside the declared list
• Generating an HMAC over an arbitrary message without a provider header format (use security.verify_hmac)
• Fetching a webhook URL or calling a provider API

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "network.validate_webhook_signature",
  "input": {
    "referenceTime": "2026-03-25T00:00:05Z",
    "signatureHeader": "t=1774396800,v1=8d062b986658ceb065e80ea46c6432744f86163bdc9b3afb11cfa8929c2011a4",
    "body": "{\"id\":\"evt_1\",\"type\":\"charge.succeeded\"}",
    "secret": "whsec_dGVzdF9zZWNyZXRfa2V5XzEyMzQ1Njc4OTAxMjM0NTY=",
    "scheme": "stripe_v1"
  }
}

Examples

{
  "referenceTime": "2026-03-25T00:00:05Z",
  "signatureHeader": "t=1774396800,v1=8d062b986658ceb065e80ea46c6432744f86163bdc9b3afb11cfa8929c2011a4",
  "body": "{\"id\":\"evt_1\",\"type\":\"charge.succeeded\"}",
  "secret": "whsec_dGVzdF9zZWNyZXRfa2V5XzEyMzQ1Njc4OTAxMjM0NTY=",
  "scheme": "stripe_v1"
}

{
  "findings": [],
  "timestamp": {
    "ageSeconds": 5,
    "value": "2026-03-25T00:00:00Z",
    "withinTolerance": true,
    "present": true
  },
  "algorithm": "HMAC-SHA256",
  "valid": true,
  "signatureCount": 1,
  "_meta": {
    "signedPayloadBytes": 51
  },
  "matchedSignatureIndex": 0,
  "scheme": "stripe_v1",
  "reason": "MATCH"
}

{
  "referenceTime": "2026-03-25T01:00:00Z",
  "signatureHeader": "t=1774396800,v1=8d062b986658ceb065e80ea46c6432744f86163bdc9b3afb11cfa8929c2011a4",
  "body": "{\"id\":\"evt_1\",\"type\":\"charge.succeeded\"}",
  "secret": "whsec_dGVzdF9zZWNyZXRfa2V5XzEyMzQ1Njc4OTAxMjM0NTY=",
  "scheme": "stripe_v1"
}

{
  "findings": [],
  "timestamp": {
    "ageSeconds": 3600,
    "value": "2026-03-25T00:00:00Z",
    "withinTolerance": false,
    "present": true
  },
  "algorithm": "HMAC-SHA256",
  "valid": false,
  "signatureCount": 1,
  "_meta": {
    "signedPayloadBytes": 51
  },
  "matchedSignatureIndex": 0,
  "scheme": "stripe_v1",
  "reason": "TIMESTAMP_STALE"
}

{
  "referenceTime": "2026-03-25T00:00:05Z",
  "signatureHeader": "t=1774396800,v1=8d062b986658ceb065e80ea46c6432744f86163bdc9b3afb11cfa8929c2011a4",
  "body": "{\"id\":\"evt_2\"}",
  "secret": "whsec_dGVzdF9zZWNyZXRfa2V5XzEyMzQ1Njc4OTAxMjM0NTY=",
  "scheme": "stripe_v1"
}

{
  "_meta": {
    "signedPayloadBytes": 25
  },
  "findings": [],
  "valid": false,
  "algorithm": "HMAC-SHA256",
  "reason": "SIGNATURE_MISMATCH",
  "scheme": "stripe_v1",
  "timestamp": {
    "ageSeconds": 5,
    "value": "2026-03-25T00:00:00Z",
    "withinTolerance": true,
    "present": true
  },
  "signatureCount": 1
}

Recommended use cases

• Authenticate Stripe, GitHub, Shopify, Slack, or Svix webhook deliveries you already received
• Reject replayed deliveries whose timestamp falls outside your tolerance window

Avoid for

• Generating an HMAC over an arbitrary message without a provider header format (use security.verify_hmac)
• Fetching a webhook URL or calling a provider API

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags