Standard Webhooks Signature Generator

What is Standard Webhooks?

Standard Webhooks is an open specification for sending webhooks the same way everywhere. Svix started it, and a steering group with members from Zapier, Twilio, ngrok, Supabase and others maintains it. It defines three headers, one signing scheme and how to rotate secrets. A receiver that verifies one Standard Webhooks provider can verify them all, and reference libraries exist for most languages. OpenAI, Anthropic and the Webhook Relay Outbound Gateway sign this way.

How Standard Webhooks signing works, step by step

1. Give each message a unique ID, such as msg_2Ld8Fq1zVbT7nXc4KpR9sWmE. Keep it the same across retries so receivers can deduplicate.
2. Take the current Unix time in seconds, such as 1791626714. Each delivery attempt gets a fresh timestamp and signature.
3. Serialize the payload to a string once. This exact string is both signed and sent as the body.
4. Build the signed content: {webhook-id}.{webhook-timestamp}.{body}, joined with dots.
5. Strip whsec_ from the secret and base64-decode the rest. Those bytes are the HMAC key.
6. Compute HMAC-SHA256 over the signed content, base64-encode the digest and prefix v1,.
7. Send the request with webhook-id, webhook-timestamp and webhook-signature headers.

Worked example

These values are precomputed, so you can check your own implementation against them.

Secret

whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw

webhook-id

msg_2Ld8Fq1zVbT7nXc4KpR9sWmE

webhook-timestamp

1791626714

{
  "type": "invoice.paid",
  "timestamp": "2026-10-11T09:25:14Z",
  "data": {
    "invoice_id": "inv_123",
    "customer_id": "cus_42",
    "amount": 4900,
    "currency": "usd",
    "status": "paid"
  }
}

webhook-signature: v1,+6HzXJOO5aA9F/t1gC1vOyPRYYU9jz+Mo/4xlQTV7fs=

Compact the same JSON to one line and the signature changes completely. HMAC signs bytes, not JSON values.

Common mistakes

• Re-serialized JSON. Signing JSON.stringify(payload) and then letting an HTTP client serialize the object again can produce different bytes, through key order, spacing or unicode escaping. Serialize once, then sign and send that same string. Receivers have the mirror bug: they parse the body and re-stringify it before verifying. Verify against the raw body.
• Using the secret as a string. The HMAC key is the base64-decoded part after whsec_. Using the literal text whsec_… as the key, or leaving the prefix on before decoding, gives a valid-looking signature that no receiver accepts.
• Milliseconds instead of seconds. Date.now() returns milliseconds (13 digits). webhook-timestamp must be seconds (10 digits). Receivers reject timestamps outside a tolerance window, typically five minutes, so a millisecond value fails even if the HMAC is right.
• Hex instead of base64. Stripe and GitHub use hex digests. Standard Webhooks uses standard base64 with padding, prefixed v1,.
• Mangled body in curl. curl -d strips newlines from the data, which changes pretty-printed JSON. Use --data-binary, as the generated command does.
• Comma-separated rotation signatures. Multiple signatures are separated by a space: v1,abc… v1,def…. The comma belongs inside each entry, between the version and the signature.

Related free tools

Receiving these webhooks? The receiving guide has verification code for Node.js and Go, plus deduplication on webhook-id.