# BitBooth Webhook Signature Verify

> BitBooth Webhook Signature Verify is a paid API for AI agents from app.heinrichstech.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-11).

Verifies a webhook signature against the provider's canonical HMAC scheme for Stripe, GitHub, Vercel, CDP, Slack, or generic HMAC-SHA256

## Facts

- Endpoint: POST https://app.heinrichstech.com/v1/cdp/webhook-sig-verify?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bitbooth-webhook-signature-verify-347520d5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_OH97vQsMKaRA3S5V0eirL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bitbooth-webhook-signature-verify-347520d5 -d '<json body>'
```

Example prompt: Can you verify this incoming Stripe webhook signature — the raw payload is the JSON body I just received, the signature header is 't=1714000000,v1=abc123...', and my Stripe signing secret is 'whsec_xyz'?

## When to prefer this

Choose this endpoint when your agent needs to cryptographically verify that an incoming webhook genuinely originated from a known provider (Stripe, GitHub, Vercel, CDP, Slack) or any generic HMAC-SHA256 scheme. It is stateless, meaning your secret never persists server-side. Prefer this over rolling your own HMAC verification when you need constant-time comparison and built-in timestamp/clock-skew handling for Stripe, Slack, and CDP.

## Known failure modes

- Invalid or mismatched signature returns verification failed with false result
- Expired timestamp (outside tolerance window) returns clock-skew error for Stripe/Slack/CDP
- Unsupported provider name returns error indicating unknown scheme
- Malformed or missing signature header returns parsing error
- Wrong secret supplied returns signature mismatch without exposing the correct secret

## How this service works

BitBooth Webhook Signature Verify: pay 0.005 USDC, verify a webhook signature against the provider's canonical HMAC scheme. Supports stripe, github, vercel, cdp, slack, and generic HMAC-SHA256. Constant-time compare, clock-skew tolerance on timestamp-bearing providers (Stripe / Slack / CDP). Stateless — caller supplies their secret in the request body, we never store it.

## Output

Returns a structured JSON response indicating whether the webhook signature is valid (boolean), the provider matched, and any error detail if the verification fails. Uses constant-time comparison to prevent timing attacks and applies clock-skew tolerance for timestamp-bearing providers like Stripe, Slack, and CDP.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "provider",
      "payload",
      "signature",
      "secret"
     ],
     "properties": {
      "secret": {
       "type": "string"
      },
      "payload": {
       "type": "string"
      },
      "provider": {
       "enum": [
        "stripe",
        "github",
        "vercel",
        "cdp",
        "slack",
        "generic"
       ],
       "type": "string"
      },
      "signature": {
       "type": "string"
      },
      "timestamp": {
       "type": "string"
      },
      "toleranceSeconds": {
       "type": "number"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bitbooth-webhook-signature-verify-347520d5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from app.heinrichstech.com](https://www.zero.xyz/host/app.heinrichstech.com/llms.txt)