04 / Webhook shield

Know what arrived. Trust what you route.

Inspect a webhook signature locally, or connect your own Meta app to an authenticated delivery endpoint.

Verify the exact payload

Runs locally

Whitespace matters. Paste the original UTF-8 body, not reformatted JSON. Inputs stay in memory and clear when you leave.

Raw webhook body

{
  "object": "whatsapp_business_account",
  "entry": [
    {
      "id": "sample-business",
      "changes": [
        {
          "field": "messages",
          "value": {
            "messaging_product": "whatsapp",
            "metadata": {
              "phone_number_id": "sample-phone"
            },
            "messages": [
              {
                "id": "wamid.example",
                "from": "15555550100",
                "timestamp": "1792535400",
                "type": "text",
                "text": {
                  "body": "Hello, I would like a quote."
                }
              }
            ]
          }
        }
      ]
    }
  ]
}

Maximum 64 KB. The example uses fictional data.

App secretUsed only for HMAC verification in this tab. Never use an access token here.

X-Hub-Signature-256 header

Know what arrived. Trust what you route.

Verify the exact payload

Small tools. More room for good work.