Guide
Check webhook signatures in the inspector
See in the inspector whether a webhook's signature matches your signing secret.
- Applies to
- Starter and higher; durable tunnels
- Time
- About 5 minutes
- What it changes
- Stores an encrypted signing secret for the tunnel.
- Last reviewed
- , by Product documentation
Before you begin
- A durable tunnel receiving webhooks.
- The signing secret from the provider: Stripe, GitHub, Slack or Shopify.
- A plan that includes webhook signature checks (Starter and higher).
What to know before you start
- The signing secret is stored encrypted and is never shown again after you save it.
- The check works on requests the inspector captured, so the tunnel must be a durable tunnel.
Steps
Step 1. Open the tunnel and find Webhook signatures.
You should see: You see a Provider list and a Signing secret box.
Step 2. Choose the provider, paste the signing secret and save.
The secret must be at least 6 characters. It is encrypted before it is stored.
You should see: The dashboard says the webhook check is saved and that new captured requests show whether their signature is valid.
Step 3. Send a webhook from the provider and open it in the inspector.
You should see: The request's detail shows whether the signature is valid.
To check: Send a request with a wrong signature. The inspector reports it as not valid.
You are done when
- New webhook requests in the inspector show whether their signature is valid.
Undo or clean up
- Choose Remove under Webhook signatures to delete the secret.
Good to know
Related
This page is part of Inspect and replay. Still stuck? Contact support.