On this pageTester
Paste a delivery your receiver rejected — the secret, the DPP-Signature header and the raw body — and the tester recomputes the signature exactly as the API does, then tells you which part is wrong. Or sign a test delivery and get the cURL command to post it to your own endpoint. The HMAC runs in your browser with WebCrypto; nothing you type leaves this page.
Tester
Runs in your browser. Nothing is sent.
Only used to write the cURL command below. Nothing is sent.
A passport.published event, compact as the API sends it. Edit freely; the signature follows.
DPP-Signature
Signing…
The real delivery also carries DPP-Delivery (the id of the delivery row); it is left out here because there is no real delivery. Run the command within 5 minutes of signing, or press Re-sign now.
What is checked
The same three steps as the verification samples in the webhooks guide, in this order:
| Step | Rule | On failure |
|---|---|---|
| Header | Split on ,, each part on the first =; t is Unix seconds, v1 is 64 hex characters. | Names the missing or malformed part. |
| Signature | hex(HMAC-SHA256(secret, t + "." + body)), compared in constant time. The key is the whole secret, whsec_ included. | Tries the usual alterations — re-formatted JSON, a trailing newline, CRLF, whitespace, the secret with or without its prefix — and reports the one that matches. |
| Time | |now − t| ≤ 300 seconds. | Gives the actual age, and whether the signature itself was right. |
Common failures
| Symptom | Cause | Fix |
|---|---|---|
| Mismatch; matches when minified | The framework parsed the JSON and you re-serialised it. | Read the raw body before any JSON middleware (e.g. express.raw, request.get_data()). |
| Mismatch; matches without the trailing newline | A copy, a log line or a test fixture added one. | Use the bytes as received. |
| Mismatch; matches with the prefix added | The secret was stored without whsec_. | Store and use the full string. |
| Mismatch; nothing explains it | Another endpoint’s secret, or one that was rotated. | Copy the current secret, or rotate it with POST /webhooks/{id}/rotate-secret. |
| Too old, signature correct | A replayed or stored delivery, or a slow queue before verification. | Verify on receipt; resend old deliveries — each attempt is signed with a fresh timestamp. |
| In the future | Your server clock is behind. | Synchronise it with NTP. |