Verify LINE Webhook Signatures
The LINE Messaging API signs each webhook with HMAC-SHA256 over the raw request body and sends the base64 result in the x-line-signature header. The key is your channel secret from the LINE Developers Console. Paste the raw body, the channel secret and the header value.
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the webhook signature verifier hub or the generic HMAC generator.
How LINE signs webhooks
- Take the raw request body exactly as received — do not parse or re-serialize it, as even changing escape characters breaks the signature.
- Compute HMAC-SHA256 using your channel secret as the key.
- Base64-encode the digest and constant-time compare it to
x-line-signature.
Verify LINE signatures in code
const crypto = require('crypto');
const expected = crypto
.createHmac('sha256', process.env.LINE_CHANNEL_SECRET)
.update(rawBody) // raw request body, unmodified
.digest('base64');
const received = req.headers['x-line-signature'];
const valid = crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(received));import hmac, hashlib, base64
expected = base64.b64encode(hmac.new(
channel_secret.encode(), raw_body, hashlib.sha256).digest()).decode()
received = request.headers['X-Line-Signature']
valid = hmac.compare_digest(expected, received)Frequently asked questions
Where is the LINE channel secret?
In the LINE Developers Console on your channel's "Basic settings" tab. It is used as a raw UTF-8 string. Re-issuing the channel secret immediately invalidates the previous one.
Why does LINE signature verification fail?
Almost always because the body was parsed and re-serialized. LINE signs the exact bytes — including escape characters and UTF-8 line breaks — so verify against the unmodified raw body before any JSON parsing.
Verify other providers
Stripe
GitHub
Shopify
Slack
Twilio
SquareReceiving LINE webhooks on a server behind a firewall or on localhost? Webhook Relay can forward them to your internal service and even verify or transform them before delivery.