2026-07-12 · 6 min read · Rahul Chitturi
- webhooks
- security
- debugging
Webhook signature checks fail when the verifier hashes different bytes than the provider signed. A JSON parser that reorders whitespace, a Base64 variant mismatch, or a rotated secret can all produce the same invalid signature error.
Start by capturing the exact verification inputs: raw request body bytes, timestamp header, signature header, algorithm name, and secret version. Do not normalize the body until you know the provider expects normalized content.
Preserve the signed body
Many frameworks parse JSON before route handlers run. That parsed object is useful for business logic, but signature verification usually needs the original raw body. Formatting the payload before hashing changes the input and guarantees a mismatch.
- Compare raw body length with parsed JSON length
- Check whether the signature is hex, Base64, or URL-safe Base64
- Verify the timestamp tolerance before replaying old samples
- Confirm which secret version signed the event
Separate encoding from cryptography
A digest is bytes. The displayed signature is an encoding of those bytes. Decode or compare the representation the provider documents, then keep the hashing algorithm, input order, and separator characters explicit in the review.
When debugging with a teammate, share synthetic webhook bodies and fake secrets. The failure mode should reproduce without exposing production event payloads or provider credentials.
A Flashman workflow
Use the Base64 tool to check signature variants, the hash tool to compare digest representations for safe samples, the JSON formatter to inspect event shape after verification, and the diff tool to compare old and new verifier code paths.
Record whether the fix changed body capture, secret selection, timestamp tolerance, or encoding assumptions. Future webhook integrations can then reuse the same checklist.