# Webhook signature compute

`webhook-signature-compute` · version 1.0.0 · Hashing & signatures · free, no key needed

Compute a signed webhook header for Stripe, Slack, Standard Webhooks, Twilio, GitHub or Shopify.

**Use when you need to: sign a test webhook payload like stripe would · generate a fake but valid slack signature for testing · compute x-hub-signature-256 for github.**

## Decide before calling

Read the [versioned contract](/v1/tools/webhook-signature-compute/versions/1.0.0) and the supported scope below. Reuse `webhook-signature-compute@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `webhook-signature-compute@1.0.0` for sign a test webhook payload like stripe would. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- sign a test webhook payload like stripe would
- generate a fake but valid slack signature for testing
- compute x-hub-signature-256 for github
- build a twilio x-twilio-signature for a test request
- shopify webhook hmac header for testing
- standard webhooks signature header

## Not supported

- verifying a received signature against a claimed secret (see the four webhook-*-verify tools)
- verifying a received GitHub or Shopify signature (no standalone verify tool for either; see the family README's rejected-tools list and use hmac-verify presets to check them)

## Behavior

- scheme 'stripe': signature = lowercase-hex(HMAC-SHA256(secret as UTF-8 verbatim, '{timestamp}.{payload}')); headers = [{name:'Stripe-Signature', value:'t={timestamp},v1={signature}'}].
- scheme 'slack': signature = 'v0=' + lowercase-hex(HMAC-SHA256(signing_secret, 'v0:{timestamp}:{body}')); headers = [{name:'X-Slack-Signature', value: signature}, {name:'X-Slack-Request-Timestamp', value: String(timestamp)}].
- scheme 'standard': secret is decoded exactly as webhook-standard-verify decodes it (strip 'whsec_' if present, base64-decode tolerating missing/already-correct padding); signature = 'v1,' + base64(HMAC-SHA256(decoded secret, '{webhook_id}.{webhook_timestamp}.{payload}')); headers = [{name:'webhook-id', ...}, {name:'webhook-timestamp', ...}, {name:'webhook-signature', value: signature}].
- scheme 'twilio': signature = base64(HMAC-SHA1(auth_token, url followed by, for each params key sorted ascending by Unicode code point (as Python's sorted() in twilio-python, not JS UTF-16 code-unit order), its deduplicated values sorted the same way, concatenated as key+value)) -- built directly over url as given (no port-variant guessing, since the caller controls the exact URL to sign); headers = [{name:'X-Twilio-Signature', value: signature}].
- scheme 'github': signature = 'sha256=' + lowercase-hex(HMAC-SHA256(secret, payload)); headers = [{name:'X-Hub-Signature-256', value: signature}] (a fixed HMAC-SHA256-hex-with-prefix preset; there is no standalone webhook-github-verify tool).
- scheme 'shopify': signature = base64(HMAC-SHA256(secret, payload)); headers = [{name:'X-Shopify-Hmac-Sha256', value: signature}] (a fixed preset, same reasoning as github).
- A field belonging to a different scheme than the one chosen is invalid_input, and a field the chosen scheme requires but omits is invalid_input.
- secret/signing_secret/auth_token are never echoed anywhere in the output.
- scheme 'twilio': Limits on params (checked before any sorting or hashing, limit_exceeded): at most 1000 values in total (max_params_values; a string value counts 1, an array counts its length, duplicates included, before deduplication), and at most 65536 UTF-8 bytes summed over every key (once per key) and every value (each array element, duplicates included) (max_params_bytes). A real Twilio form post is a few KB with a few dozen fields.

## Input

- `scheme` (one of "stripe", "slack", "standard", "twilio", "github", "shopify", required)
- `payload` (string, optional): max length 262144
- `secret` (string, optional): min length 1; max length 512
- `timestamp` (integer, optional): min 0; max 99999999999
- `body` (string, optional): max length 262144
- `signing_secret` (string, optional): min length 1; max length 512
- `webhook_id` (string, optional): min length 1; max length 256
- `webhook_timestamp` (string, optional): pattern `^[0-9]{1,16}$`
- `url` (string, optional): min length 1; max length 4096
- `params` (object, optional)
- `auth_token` (string, optional): min length 1; max length 512

## Output

- `scheme` (one of "stripe", "slack", "standard", "twilio", "github", "shopify", required)
- `headers` (array of object, required): min items 1; max items 3
- `signature` (string, required): min length 1

## Limits

- max payload bytes: 262144
- max url bytes: 4096
- max params bytes: 65536
- max params values: 1000

## Example

Request input:

```json
{
  "scheme": "github",
  "payload": "{\"zen\":\"Non-blocking is better than blocking.\"}",
  "secret": "test-secret"
}
```

Response:

```json
{
  "result": {
    "scheme": "github",
    "headers": [
      {
        "name": "X-Hub-Signature-256",
        "value": "sha256=6227df376409e5e6097374f5a7e8f28f40faf1aa9b7c83df6d70b59eb087f476"
      }
    ],
    "signature": "sha256=6227df376409e5e6097374f5a7e8f28f40faf1aa9b7c83df6d70b59eb087f476"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "webhook-signature-compute",
  "version": "1.0.0",
  "input": {
    "scheme": "github",
    "payload": "{\"zen\":\"Non-blocking is better than blocking.\"}",
    "secret": "test-secret"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/webhook-signature-compute/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"scheme":"github","payload":"{\"zen\":\"Non-blocking is better than blocking.\"}","secret":"test-secret"}'
```

The machine-readable contract is at [/v1/tools/webhook-signature-compute/versions/1.0.0](/v1/tools/webhook-signature-compute/versions/1.0.0).

### CLI

```sh
node cli.mjs run webhook-signature-compute 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Hmac verify](/tools/hmac-verify): Recompute an HMAC and compare it, constant-time, to a signature that may carry a literal prefix and be truncated.
- [Hmac compute](/tools/hmac-compute): Compute HMAC-SHA256/SHA512/MD5/SHA-1/SHA-3/RIPEMD-160 (RFC 2104) over encoded key and message bytes.
- [Webhook slack verify](/tools/webhook-slack-verify): Verify a Slack request's X-Slack-Signature against its raw body and timestamp, with an absolute replay-window check.
- [Webhook standard verify](/tools/webhook-standard-verify): Verify a Standard Webhooks (Svix/Clerk/Resend) webhook-signature header against its id.timestamp.payload signing string.
- [Git object id compute](/tools/git-object-id-compute): Compute the Git object id git itself would give a blob, tree, commit or tag under Git's exact object framing.
- [Webhook stripe verify](/tools/webhook-stripe-verify): Verify a Stripe webhook's Stripe-Signature header against a raw payload, with secret-rotation and tolerance support.