FAQ
Why doesn't my webhook signature match?
In 9 of 10 cases the code signs a re-serialized JSON object instead of the raw request body. Frameworks parse JSON and when you stringify it again spacing, key order and escaping change. Always compute the HMAC over the raw bytes you received. Other causes: wrong secret (test vs live), hex vs base64 output, a timestamp prefix (Stripe signs timestamp.body), or comparing upper- vs lower-case hex.
What does “Find why it doesn't match” do?
It tries hundreds of combinations — algorithms (SHA-1/256/384/512), secret encodings (text, hex, base64, Svix whsec_), body variants (minified, pretty, sorted keys, trailing newline, PHP/Python JSON styles, timestamp prefixes) and output formats — and tells you which one the provider used.
Is it safe to paste my secret?
All signing happens locally with the Web Crypto API; the secret never leaves your browser. The AI button only sends the provider name, settings and the body sample — never the secret. Still, prefer test-environment secrets.