# Webhook Signature Fixture Lab

> Webhook Signature Fixture Lab is a paid API for AI agents from mcp-factory.bowling-anthony.workers.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Generates test fixtures for HMAC-SHA256 webhook signature verification, including valid, tampered, and wrong-signature cases

## Facts

- Endpoint: POST https://mcp-factory.bowling-anthony.workers.dev/webhook-signature-fixture-lab/analyze
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/webhook-signature-fixture-lab-95b1ec4d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ot4bvLknOg06rmC5IEH6w

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability webhook-signature-fixture-lab-95b1ec4d -d '<json body>'
```

Example prompt: Generate webhook signature test fixtures for my payload 'Hello, World!' using my secret key — I need valid, tampered payload, and wrong signature cases so I can test my X-Hub-Signature-256 verification logic.

## When to prefer this

Choose this endpoint when you need to generate comprehensive, ready-to-use HMAC-SHA256 webhook signature test fixtures — especially for GitHub-style X-Hub-Signature-256 verification. It is ideal for developers who want deterministic test vectors covering valid, tampered, and invalid signature scenarios without writing the crypto logic themselves. Prefer this over manual fixture creation when you need multiple edge-case scenarios in a single call.

## Known failure modes

- Missing or invalid payload body returns error
- Missing secret key causes signature generation failure
- Malformed request body results in 400-level error
- Payment failure (x402) blocks call execution
- Insufficient USDC balance prevents call from completing

## How this service works

Customer-input analysis tools with per-call x402 v2 USDC payments on Base. Discovery and examples are free.

## Output

Returns a JSON object containing: the generated X-Hub-Signature-256 header value, an array of named test fixtures (valid, tampered_payload, wrong_signature) each with their header, payload, and expected validation outcomes (expected_accepted, expected_signature_valid, expected_time_valid), a verification field, and the SHA-256 hash of the payload. Each fixture specifies whether it should be accepted and whether the signature is valid, enabling automated test assertions.

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "scope": "generated_fixtures_only",
  "header": {
   "name": "X-Hub-Signature-256",
   "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
  },
  "fixtures": [
   {
    "name": "valid",
    "header": {
     "name": "X-Hub-Signature-256",
     "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
    },
    "payload": "Hello, World!",
    "expected_accepted": true,
    "expected_time_valid": null,
    "expected_signature_valid": true
   },
   {
    "name": "tampered_payload",
    "header": {
     "name": "X-Hub-Signature-256",
     "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
    },
    "payload": "Hello, World!!",
    "expected_accepted": false,
    "expected_time_valid": null,
    "expected_signature_valid": false
   },
   {
    "name": "wrong_signature",
    "header": {
     "name": "X-Hub-Signature-256",
     "value": "sha256=057107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
    },
    "payload": "Hello, World!",
    "expected_accepted": false,
    "expected_time_valid": null,
    "expected_signature_valid": false
   }
  ],
  "verification": null,
  "payload_sha256": "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/webhook-signature-fixture-lab-95b1ec4d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from mcp-factory.bowling-anthony.workers.dev](https://www.zero.xyz/host/mcp-factory.bowling-anthony.workers.dev/llms.txt)