# Sicher Webhook Signature Verifier

> Sicher Webhook Signature Verifier is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Verifies a webhook payload signature against the canonical signing scheme of a named provider, using constant-time comparison, and returns the reconstructed signed string for debugging mismatches.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/webhook-signature?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sicher-webhook-signature-verifier-74a69c9d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6yWWrJk1Os7ST3847_kys

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sicher-webhook-signature-verifier-74a69c9d -d '<json body>'
```

Example prompt: Check whether this incoming Stripe webhook signature is valid — here's the raw body, the Stripe-Signature header value, and our webhook signing secret — and if it fails, show me the string that was actually signed so I can figure out what went wrong.

## When to prefer this

Use this endpoint when you need provider-accurate webhook signature verification that faithfully implements the exact signing algorithm (including timestamp prepending, ID ordering, or version markers) as each provider specifies — not a generic HMAC check. It is especially valuable when debugging mismatches because it returns the reconstructed signed string, saving engineers from guessing at signing order issues.

## Known failure modes

- Unknown or unsupported provider name — endpoint cannot construct the signing string
- Missing or malformed signature header — returns validation error
- Incorrect secret provided — signature will not match but the signed string is still returned for debugging
- Malformed request body — signing string construction fails
- Timestamp outside acceptable skew window — may flag as replay attack depending on provider spec

## How this service works

Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.

## Output

Returns whether the signature is valid (boolean), the reconstructed string that was signed according to the named provider's specification, and diagnostic details describing why a mismatch occurred, enabling developers to debug signing order or encoding issues without guessing.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "body": {
   "type": "string",
   "maxLength": 200000,
   "description": "The raw request body exactly as received, not re-serialised."
  },
  "secret": {
   "type": "string",
   "maxLength": 2000,
   "minLength": 1,
   "description": "The signing secret."
  },
  "headers": {
   "type": "object",
   "description": "All request headers; the right one is picked by provider."
  },
  "provider": {
   "enum": [
    "github",
    "stripe",
    "shopify",
    "slack",
    "svix",
    "generic_hmac"
   ],
   "type": "string",
   "description": "Which provider signed the request."
  },
  "signature": {
   "type": "string",
   "maxLength": 2000,
   "description": "The signature header value. Required unless headers is given."
  },
  "timestamp": {
   "type": "string",
   "maxLength": 40,
   "description": "Timestamp, if the provider signs one and it is not in the headers."
  },
  "message_id": {
   "type": "string",
   "maxLength": 200,
   "description": "Message id for schemes that sign one, e.g. Svix."
  },
  "tolerance_seconds": {
   "type": "integer",
   "default": 300,
   "maximum": 86400,
   "minimum": 1,
   "description": "How old a signed timestamp may be."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sicher-webhook-signature-verifier-74a69c9d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)