Guide
Webhook Signature Schemes
Most providers sign webhooks with HMAC, but the exact input is not universal. Some sign only the raw body, some include timestamps or ids, some sign the URL, and some use public-key verification instead of a shared secret.
79 source types6 scheme groupsGenerated from source docsProvider pages stay canonical
How to use this matrix
Use this page to identify the verification family. Then open the provider source page for the exact header names, FastHook field, setup challenge, and official provider documentation.
Raw body means exact body.Do not trim, reformat, or reserialize JSON before checking a digest.
Timestamped signatures include metadata.The separator and prefix matter as much as the algorithm.
URL-aware signatures are brittle by design.Changing query strings, hosts, or callback URLs can invalidate signatures.
Public-key schemes do not share a secret.Configure the public key, webhook id, certificate, or app public key instead.
32 source types
Raw-body HMAC
The provider signs the exact request body. Encoding, whitespace, key order, and line endings must match the bytes FastHook receives.raw body, usually HMAC-SHA256; some providers use SHA-1, SHA-512, hex, or base64 output16 source types
Timestamped HMAC
The provider includes a timestamp, message id, or version prefix in the signed value. FastHook verifies both the header shape and the provider-specific signing input.timestamp or message metadata plus raw body, joined with the provider's required separator6 source types
Svix and Standard Webhooks
These providers use a message id, timestamp, and signature header pattern. FastHook handles the canonical message string and whsec-style secret formats.message id + timestamp + raw body4 source types
URL-aware signatures
The callback URL, request URI, form parameters, or callback URL value is part of the signature input. Changing provider URLs or query strings can break verification.public URL or request URI plus body or form fields5 source types
Public-key and RSA verification
The provider signs with its private key. FastHook verifies with a public verification key, certificate, webhook id, or application public key.provider canonical string plus public-key verification7 source types
Token, Basic Auth, and challenge checks
Some providers prove identity with a static header, query secret, Basic Auth credentials, validation token, or one-time challenge instead of body hashing.configured header or query value, Basic Auth credentials, client state, or setup challenge token9 source types
Other source checks
Source types that are not yet classified into one of the main scheme groups.Debugging checklist
- Match the provider source type before deciding which secret or public key to paste into FastHook.
- Check the exact signature header and prefix on the provider page, not just the algorithm name.
- For HMAC failures, compare the raw body FastHook received with the body your test command signed.
- For timestamped schemes, confirm the timestamp header, separator, version prefix, and clock tolerance.
- For URL-aware schemes, keep the provider callback URL stable after registration.
- Use Requests to inspect rejected source auth records before debugging connection or destination delivery.