Webhook payload inspector

Paste a webhook body, its X-Wasla-Signature header and your secret: the signature and the envelope are checked locally in your browser.

Nothing leaves your browser

The check runs with your browser’s Web Crypto. The body, the header and the secret are not sent anywhere and not saved. Still, prefer a test secret: rotate a production secret you pasted on a shared computer.

Raw request bodyExactly the bytes your server received.

X-Wasla-Signature headerSigning secretUsed only here, in memory. Never stored or sent.

Common mistakes

Symptom	Cause
Signature mismatch	CauseThe body was parsed and re-serialised (spaces / key order / unicode escapes changed). Verify the raw bytes.
Signature mismatch after rotating	CauseYour server still uses the old secret.
Timestamp too old	CauseThe server clock is off by more than 5 minutes, or a request is being replayed.
Unknown event type	CauseA new event type — log it and answer 2xx.