ANY PLATFORM WEBHOOKS
Webhook signature verification invalid — rejecting real events
Signature failures mean traffic is arriving fine but every event is being rejected. From the sender’s side it looks like a misconfigured endpoint; from yours it’s silent — no events processed, and often no error logging on the rejection path.
Why Any platform webhooks fail silently
Secret rotation drift
Someone rotated the signing secret in one place but not the other — classic after a security review.
Body transformed pre-verification
JSON parsing, compression middleware, or a proxy that rewrites the body makes the signature unverifiable.
Algorithm or format mismatch
Hex vs base64, wrong hash, wrong signed-content format (timestamp.body vs body alone) — tiny mismatches reject everything.
The fix
- 1
Re-verify the contract against docs
Check exactly what the sender signs: which bytes, which algorithm, which encoding. Match it byte-for-byte.
- 2
Verify before any parsing
Signature check runs on the raw request body — before JSON.parse, before any middleware that touches the body.
- 3
Sync secrets deliberately
Support secret rotation with two active secrets during rollover — verify against either, never hard-fail on one.
- 4
Count rejections
HookShield logs the target’s response per delivery — an all-401 stream is as visible as a down endpoint on the dashboard.
DEAD-MAN'S SWITCH
Never find out about a dead webhook from a customer again
Point Any platform at a HookShield ingest URL. Every delivery is logged, signed, and forwarded — and if pings stop arriving, you're alerted before the silence becomes an incident.