Webhook Verification Readiness

Status

archived

Published

2026-07-29

Modified

2026-07-29

Category

product

Included changes

1. 01The public workbench verifies the exact timestamp and raw-body signing input locally without submitting or persisting entered values.
2. 02The read-only verification-kit endpoint publishes header names, signing format, a deterministic public test vector and Node/Python examples.
3. 03Strict helpers reject empty secrets, malformed headers, invalid timestamps, stale messages and signature mismatches.
4. 04The static vector is identified as a historical signature-compatibility fixture with a fixed freshness reference.

Interpretation boundaries

• 01Passing the static vector establishes compatibility with that fixture only; production receivers must enforce current-time freshness and replay protection.
• 02The release provides no endpoint registration, subscriptions, production secrets, push delivery, retries, key rotation or delivery receipts.

Evidence links