---
title: "Verify Airwallex Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Airwallex webhook signature verifier. Validate the x-signature header against your webhook secret and x-timestamp. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Airwallex Webhook Signatures — Free Online Tool"
description: "Free online Airwallex webhook signature verifier. Validate the x-signature header against your webhook secret and x-timestamp. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Airwallex Webhook Signatures**
Airwallex signs each webhook by concatenating the `x-timestamp` value with the raw request body and computing HMAC-SHA256 with your endpoint's webhook secret. The **hex** result is sent in the `x-signature` header. Paste the raw body, the timestamp, your secret and the signature.
**Raw request body (payload)**
**Timestamp** (x-timestamp)
**Webhook secret key**
**Computed signature**
**Signature to verify **(x-signature)
**Paste the x-signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-airwallex-webhook-signature/hmac-verification/).
## **How Airwallex signs webhooks**
1. Read the `x-timestamp` header (a Unix time in **milliseconds**).
2. Build the signed value by concatenating the timestamp directly with the **raw** request body: timestamp first, body second, no separator.
3. Compute HMAC-SHA256 of that value using your endpoint's webhook secret as the key, hex-encoded.
4. Constant-time compare it to `x-signature`, and reject events whose `x-timestamp` is too old to block replays.
**References & official docs:**
- [Airwallex — Listen for webhook events (check signatures)](https://www.airwallex.com/docs/developer-tools/webhooks/listen-for-webhook-events)
- [Airwallex — Webhook code examples](https://www.airwallex.com/docs/developer-tools/webhooks/listen-for-webhook-events/code-examples)
## **Verify Airwallex signatures in code**
**Node.js**
```
const crypto = require('crypto');
const ts = req.headers['x-timestamp'];
const expected = crypto
.createHmac('sha256', process.env.AIRWALLEX_WEBHOOK_SECRET)
.update(ts + rawBody) // timestamp + raw body, no separator
.digest('hex');
const valid = crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(req.headers['x-signature']));
```
**Python**
```
import hmac, hashlib
ts = request.headers['x-timestamp']
expected = hmac.new(
webhook_secret.encode(), ts.encode() + raw_body, hashlib.sha256).hexdigest()
valid = hmac.compare_digest(expected, request.headers['x-signature'])
```
## **Frequently asked questions**
**Which secret signs Airwallex webhooks?**
The webhook secret shown when you create the webhook (notification URL) in the Airwallex web app. Each endpoint has its own secret and it is used as a raw string — it is not your API key or client ID.
**Is x-timestamp in seconds or milliseconds?**
Milliseconds since the Unix epoch. Compare it against the current time in milliseconds and reject events outside your tolerance. Airwallex does not mandate a window; a few minutes is a sensible default.
**Why does verification fail with the correct secret?**
Usually the body was re-serialized. Airwallex signs the exact raw bytes, so verify against the unparsed request body and prepend the timestamp with no separator (`x-timestamp + body`).
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-shopify-webhook-signature/) [ Slack](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-slack-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-twilio-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-line-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-airwallex-webhook-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-airwallex-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-airwallex-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-airwallex-webhook-signature/webhook-bin/)
Receiving Airwallex webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-airwallex-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-airwallex-webhook-signature/features/transform-webhooks/) before delivery.