Free Stripe, Shopify & RevClamp Webhook HMAC-SHA256 Signature Tester
Generate and verify canonical Stripe-Signature (t=<unix>,v1=<hex>), X-Shopify-Hmac-Sha256 (Base64), and X-RevClamp-Signature headers over exact UTF-8 payload bytes. Enforces a Zero-Trust guard that blocks known live/production credential patterns (sk_live_, rk_live_, non-test whsec_..., shpss_..., shpat_..., rc_live_) from entering the sandbox.
1. Webhook Provider, Sandbox Secret & Raw UTF-8 Payload
Use the pre-filled synthetic sandbox secret (whsec_test_revclamp_sandbox_secret_2026) or any test secret. Known live/production credential patterns (sk_live_, rk_live_, non-test whsec_..., shpss_..., shpat_..., rc_live_) are rejected with 400 LIVE_SECRET_FORBIDDEN_IN_SANDBOX.
2. Canonical Header, Timing-Safe Verdict & Replay Skew
Displays the canonical HTTP header string, SHA-256 payload digest, 300-second replay window status, and full JSON diagnostic output.
crypto.timingSafeEqual verification.
Stripe-Signature: t=...,v1=...
Awaiting signature verification...
3. Webhook Cryptographic Verification Matrix & Common Middleware Traps
Why webhook signature checks fail in Express, Next.js App Router, and Cloudflare Workers when body-parsing middleware mutates raw UTF-8 bytes.
| Provider / Guard | HTTP Header & Encoding | Canonical Signed Message | Common Integration Bug & Deterministic Fix |
|---|---|---|---|
| Stripe Webhooks | Stripe-Signature (Hex v1) |
${timestampSec}.${rawPayloadUtf8} |
express.json() re-orders keys before HMAC; verify over raw Buffer + 300s skew guard |
| Shopify Plus B2B | X-Shopify-Hmac-Sha256 (Base64) |
rawPayloadUtf8 (unparsed bytes) |
Using .digest("hex") instead of .digest("base64") with crypto.timingSafeEqual |
| RevClamp Outbound Guard | X-RevClamp-Signature (Hex v1) |
${timestampSec}.${rawPayloadUtf8} |
Mutating entitlement cache before validating |now - t| <= 300s and v1 digest |
| Replay Window Tolerance | toleranceSeconds: 300 (±5 min) |
Math.abs(nowSec - timestampSec) <= 300 |
Accepting stale captured webhook payloads without checking Unix timestamp skew |
| Zero-Trust Sandbox Guard | 400 LIVE_SECRET_FORBIDDEN_IN_SANDBOX |
Blocks known live/production credential patterns (sk_live_, rk_live_, non-test whsec_..., shpss_..., shpat_..., rc_live_) |
Prevents developers from leaking production signing keys into browser debugging tools |