webhook-hmac

Verify generic HMAC-SHA256 signatures

Check a raw UTF-8 payload against a shared-secret hexadecimal signature.

1 credits · USD $0.001

Input schema

{
  "type": "object",
  "properties": {
    "secret": {
      "type": "string",
      "maxLength": 1000,
      "x-maxUtf8Bytes": 1000
    },
    "payload": {
      "type": "string",
      "maxLength": 50000,
      "x-maxUtf8Bytes": 50000
    },
    "signature": {
      "type": "string",
      "maxLength": 100,
      "x-maxUtf8Bytes": 100
    }
  },
  "required": [
    "secret",
    "payload",
    "signature"
  ]
}

Request

curl -X POST 'https://staging.callmint.dev/v1/webhook-hmac' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Idempotency-Key: unique-request-001' \
  -H 'Content-Type: application/json' \
  -d '{"secret":"key","payload":"The quick brown fox jumps over the lazy dog","signature":"f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8"}'

Response result

{
  "valid": true,
  "algorithm": "HMAC-SHA256",
  "note": "Generic raw-body hex HMAC only; not a Stripe signature verifier"
}

Limitations

Generic raw UTF-8 HMAC only. Not a Stripe webhook verifier. Signature accepts 64 hex characters with an optional sha256= prefix. Do not send production secrets unless you accept processing them by this service; request bodies are not logged or retained.

All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.