Webhook signature verifier (HMAC) API

Paste the raw body, your webhook secret and the signature you received. The page computes the HMAC in your browser, tells you whether it matches and, when it doesn't, which usual mistake would make it match.

• Endpoint: POST https://postboost.co/app/api/tools/webhook-signature-verifier (operationId verifyWebhookSignature)
• Web tool: postboost.co/tools/webhook-signature-verifier
• Token: optional (limits)
• MCP: tool verify-webhook-signature on https://postboost.co/mcp/tools

Request

Field	Type	Default	Description
body	string		The raw request body exactly as received (up to 64 KB). Use a test payload, not production data.
secret	string		The webhook secret. Use a test secret: never send a production secret to any third-party service.
signature	string		The received signature header value, e.g. X-Signature.
algorithm	string: sha256, sha1, sha512	"sha256"
encoding	string: hex, base64	"hex"
prefix	string	""	A prefix the sender puts before the signature, e.g. "sha256=" (GitHub).

Call it

curl

curl -X POST https://postboost.co/app/api/tools/webhook-signature-verifier \
  -H 'Content-Type: application/json' \
  -d '{"body":"{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}","secret":"whsec_test","signature":"a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"}'

Python

from postboost import ApiClient, Configuration
from postboost.api.free_tools_api import FreeToolsApi
from postboost.models import FreeToolVerifyWebhookSignatureRequest

with ApiClient(Configuration()) as client:
    api = FreeToolsApi(client)
    result = api.verify_webhook_signature(FreeToolVerifyWebhookSignatureRequest.from_dict({"body": "{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}", "secret": "whsec_test", "signature": "a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"}))
    print(result.to_dict())

Node.js

import { FreeToolsApi } from 'postboost';

const api = new FreeToolsApi();
const { body } = await api.verifyWebhookSignature({ body: "{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}", secret: "whsec_test", signature: "a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a" });
console.log(body);

PHP

use PostBoostClient\Api\FreeToolsApi;
use PostBoostClient\Model\FreeToolVerifyWebhookSignatureRequest;

$api = new FreeToolsApi(new GuzzleHttp\Client());
$result = $api->verifyWebhookSignature(new FreeToolVerifyWebhookSignatureRequest(['body' => "{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}", 'secret' => "whsec_test", 'signature' => "a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"]));
echo $result;

Go

import (
    "context"
    "encoding/json"
    "fmt"

    postboost "github.com/postboost-co/postboost-go"
)

var request postboost.FreeToolVerifyWebhookSignatureRequest
if err := json.Unmarshal([]byte(`{"body":"{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}","secret":"whsec_test","signature":"a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"}`), &request); err != nil {
    panic(err)
}

client := postboost.NewAPIClient(postboost.NewConfiguration())
result, _, err := client.FreeToolsAPI.VerifyWebhookSignature(context.Background()).FreeToolVerifyWebhookSignatureRequest(request).Execute()
fmt.Println(result, err)

Ruby

require 'postboost'

api = PostBoost::FreeToolsApi.new
result = api.verify_webhook_signature(PostBoost::FreeToolVerifyWebhookSignatureRequest.new({ body: "{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}", secret: "whsec_test", signature: "a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a" }))
puts result.to_hash

Java

import com.postboost.ApiClient;
import com.postboost.api.FreeToolsApi;
import com.postboost.model.FreeToolVerifyWebhookSignatureRequest;
import com.postboost.model.FreeToolVerifyWebhookSignatureResponse;

FreeToolsApi api = new FreeToolsApi(new ApiClient());
FreeToolVerifyWebhookSignatureRequest request = FreeToolVerifyWebhookSignatureRequest.fromJson("{\"body\":\"{\\\"event\\\":\\\"post.published\\\",\\\"data\\\":{\\\"uuid\\\":\\\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\\\"}}\",\"secret\":\"whsec_test\",\"signature\":\"a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a\"}");
FreeToolVerifyWebhookSignatureResponse result = api.verifyWebhookSignature(request);
System.out.println(result.toJson());

C#

using Newtonsoft.Json;
using PostBoost.Client.Api;
using PostBoost.Client.Client;
using PostBoost.Client.Model;

var api = new FreeToolsApi(new Configuration());
var request = JsonConvert.DeserializeObject<FreeToolVerifyWebhookSignatureRequest>(@"{""body"":""{\""event\"":\""post.published\"",\""data\"":{\""uuid\"":\""0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\""}}"",""secret"":""whsec_test"",""signature"":""a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a""}");
var result = await api.VerifyWebhookSignatureAsync(request);
Console.WriteLine(result.ToJson());

Rust

use postboost::apis::configuration::Configuration;
use postboost::apis::free_tools_api;
use postboost::models::FreeToolVerifyWebhookSignatureRequest;

let config = Configuration::new();
let request: FreeToolVerifyWebhookSignatureRequest = serde_json::from_str(r##"{"body":"{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}","secret":"whsec_test","signature":"a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"}"##)?;
let result = free_tools_api::verify_webhook_signature(&config, request).await?;
println!("{:?}", result);

CLI

echo '{"body":"{\"event\":\"post.published\",\"data\":{\"uuid\":\"0b8f1c2e-6c1d-4f7a-9a51-3d1e2f4a5b6c\"}}","secret":"whsec_test","signature":"a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a"}' | ./postboost-cli --content-type application/json verifyWebhookSignature -

With a token, send Authorization: Bearer YOUR_API_TOKEN as a default header (how, per SDK).

Response

{
    "valid": true,
    "expected": "a27f6d074108ea6b5df903d3ad4520113a47aa3710cb26c24fab7e36457d915a",
    "hints": []
}

With MCP

Connect https://postboost.co/mcp/tools (setup) and ask, for example: Verify an HMAC webhook signature with the PostBoost verify-webhook-signature tool.

Errors

Status	When
401	The Authorization header holds an invalid token. Leave it out to call as a guest.
413	The JSON body is larger than 128 KB.
422	A field is invalid; the body lists the errors per field.
429	A limit is reached; see limits.