Webhook Signature Vault

One endpoint. Twelve platforms. Verify every inbound webhook in one POST.

StripeGitHubShopifySlackTwilioSendGridLemon SqueezyPayPalLinearNotionVercelCloudflare+ Generic HMAC

Per-Platform Algorithms

SHA-1, SHA-256, ECDSA-P256, static token, Slack v0, Stripe t=/v1=, Twilio URL+params — all handled.

Replay Protection

Tolerance windows for Stripe (300s), Slack (300s), SendGrid timestamp checks built in.

Timing-Safe Compare

Constant-time signature comparison. Web Crypto API. No third-party crypto deps.

Zero State

Stateless verifier. Your secret never leaves the request. Cloudflare edge, sub-50ms p95.

curl -X POST https://api.lazy-mac.com/webhook-signature-vault/verify \ -H "content-type: application/json" \ -d '{"platform":"github","secret":"YOUR_SECRET","payload":"{\"action\":\"opened\"}","signature":"sha256=abc..."}'

View OpenAPI Spec