# Agent402 Webhook HMAC Signature Verifier > Agent402 Webhook HMAC Signature Verifier is a paid API for AI agents from agent402.tools, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15). Verifies webhook HMAC signatures for GitHub, Stripe, Shopify, and Slack using each provider's exact signing scheme, including replay protection. ## Facts - Endpoint: POST https://agent402.tools/api/webhook-verify - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-15 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/agent402-webhook-hmac-signature-verifier-86c7d7a4 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_WcKACCnEntvhtba8A3WSC Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability agent402-webhook-hmac-signature-verifier-86c7d7a4 -d '' ``` Example prompt: Can you verify this incoming Stripe webhook for me? The raw body is '{"id":"evt_123","type":"payment_intent.succeeded"}', the Stripe-Signature header is 't=1714000000,v1=abc123def456', my webhook secret is 'whsec_mysecretkey', and the timestamp is '1714000000' — use a 300-second replay tolerance. ## When to prefer this Use this endpoint when you need to cryptographically verify that an incoming webhook genuinely originated from GitHub, Stripe, Shopify, or Slack — especially when you want to avoid implementing each provider's specific HMAC scheme (sha256 hex for GitHub, timestamped HMAC for Stripe, base64 HMAC for Shopify, v0= scheme for Slack) and replay-attack protection yourself. ## Known failure modes - Invalid or mismatched signature returns a failed verification result - Timestamp outside tolerance window triggers replay protection failure for Stripe/Slack - Missing required timestamp for Stripe or Slack causes error - Unknown provider value returns an error indicating unsupported provider - Malformed signature header format causes parsing error - Raw body was re-serialized (not byte-for-byte original) leading to false negative ## How this service works Verify a webhook's HMAC signature against the correct per-provider scheme: GitHub (X-Hub-Signature-256, sha256=hex), Stripe (Stripe-Signature t/v1 over "." with replay tolerance), Shopify (X-Shopify-Hmac-Sha256, base64), Slack (X-Slack-Signature, v0:: with replay tolerance). Constant-time comparison; the secret is never echoed. Pass the RAW request body string - signatures are over the raw bytes. Deterministic. ## Output Returns whether the HMAC signature is valid or invalid for the given provider's scheme, incorporating timestamp-based replay protection for Stripe and Slack. The signing secret is never echoed back in the response. ## Request schema (JSON Schema) ```json { "type": "object", "properties": { "secret": { "type": "string", "description": "the provider signing secret (never echoed back)" }, "payload": { "type": "string", "description": "the RAW request body string, byte-for-byte as received (never a re-serialized object)" }, "provider": { "type": "string", "description": "github | stripe | shopify | slack" }, "signature": { "type": "string", "description": "the signature header value, with or without its scheme prefix (sha256= / v0= / t=...,v1=...)" }, "timestamp": { "type": "string", "description": "provider timestamp, required for stripe + slack (stripe may be parsed from a t= element in the signature)" }, "toleranceSeconds": { "type": "number", "description": "max timestamp age for stripe/slack replay protection (default 300; 0 skips the age check)" } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "valid": true, "reason": "signature matches the recomputed HMAC for this payload and secret", "scheme": "X-Hub-Signature-256: sha256=hex(HMAC-SHA256(secret, rawBody))", "provider": "github" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-webhook-hmac-signature-verifier-86c7d7a4/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)