Webhook signature check

When a webhook signature fails, the cause is usually the body, the secret or the timestamp. Paste the exact request and see what the expected signature should be.

Provider Signing secret Raw request body (exactly as received) Signature header value

Timestamp header (Slack: X-Slack-Request-Timestamp)Tolerance (seconds)

The body must be the raw bytes the provider sent. Re-formatting JSON, changing line endings or trailing newlines changes the signature. Use test secrets here, not live ones, if you're not sure about the device you're on.