---
title: "Verify Zendesk Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Zendesk webhook signature verifier. Validate the X-Zendesk-Webhook-Signature header against your webhook signing secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Zendesk Webhook Signatures — Free Online Tool"
description: "Free online Zendesk webhook signature verifier. Validate the X-Zendesk-Webhook-Signature header against your webhook signing secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Zendesk Webhook Signatures**
Zendesk signs every webhook with HMAC-SHA256 over the delivery timestamp concatenated with the raw body, base64-encodes it and sends it in the `X-Zendesk-Webhook-Signature` header, with the timestamp in `X-Zendesk-Webhook-Signature-Timestamp`. Paste the raw body, the timestamp header value and your signing secret below.
**Raw request body (payload)**
Paste the **raw** request body exactly as received. Some Zendesk deliveries (e.g. test pings) have an empty body — the timestamp alone is signed then.
**Timestamp** (X-Zendesk-Webhook-Signature-Timestamp)
**Webhook signing secret**
**Computed signature**
**Signature to verify **(X-Zendesk-Webhook-Signature)
**Paste the X-Zendesk-Webhook-Signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-zendesk-webhook-signature/hmac-verification/).
## **How Zendesk signs webhooks**
1. Read `X-Zendesk-Webhook-Signature` (the signature) and `X-Zendesk-Webhook-Signature-Timestamp` (an ISO-8601 timestamp) from the request.
2. Build the signed string: the timestamp value immediately followed by the **raw** request body (no separator).
3. Compute HMAC-SHA256 of that string with your webhook signing secret as the key, then base64-encode the digest.
4. Compare it to the header with a constant-time check, and reject deliveries whose timestamp is too old to defend against replays.
**References & official docs:**
- [Zendesk — Verifying webhook authenticity](https://developer.zendesk.com/documentation/webhooks/verifying/)
- [Zendesk — Webhooks overview](https://developer.zendesk.com/documentation/webhooks/)
## **Verify Zendesk signatures in code**
**Node.js**
```
const crypto = require('crypto');
// body must be the RAW request body (string/Buffer), not parsed JSON.
function isValidZendeskWebhook(body, signature, timestamp, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(timestamp + body)
.digest('base64');
return crypto.timingSafeEqual(
Buffer.from(expected), Buffer.from(signature));
}
const ok = isValidZendeskWebhook(
rawBody,
req.headers['x-zendesk-webhook-signature'],
req.headers['x-zendesk-webhook-signature-timestamp'],
process.env.ZENDESK_SIGNING_SECRET);
```
**Python**
```
import base64, hashlib, hmac
def is_valid_zendesk_webhook(body: bytes, signature: str,
timestamp: str, secret: str) -> bool:
digest = hmac.new(secret.encode(),
timestamp.encode() + body,
hashlib.sha256).digest()
expected = base64.b64encode(digest).decode()
return hmac.compare_digest(expected, signature)
```
## **Frequently asked questions**
**Where do I find the Zendesk webhook signing secret?**
In Admin Center open the webhook's details page and click _Reveal secret_, or call `GET /api/v2/webhooks/{webhook_id}/signing_secret`. Each webhook has its own secret.
**What exactly does Zendesk sign?**
The value of `X-Zendesk-Webhook-Signature-Timestamp` concatenated directly with the raw request body — no separator between them. Requests without a body (some test deliveries) sign the timestamp alone.
**Why does my verification fail with the right secret?**
Usually the body was re-serialized before hashing (parse-then-stringify changes bytes), or the timestamp header was omitted from the signed string. Always verify against the raw bytes Zendesk sent, prefixed with the timestamp value.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-shopify-webhook-signature/) [ Slack](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-slack-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-twilio-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-myfatoorah-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-zendesk-webhook-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-zendesk-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-zendesk-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-zendesk-webhook-signature/webhook-bin/)
Receiving Zendesk webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-zendesk-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-zendesk-webhook-signature/features/transform-webhooks/) before delivery.