Browser-only verifier

Lemon Squeezy x-signature checker for raw webhook bodies.

Paste the exact request body, webhook signing secret, and received `x-signature` value. The HMAC is computed locally with Web Crypto and never leaves the browser.

Signature input

Exact bytes matter

Raw request body Webhook signing secret Received x-signature

Result

HMAC SHA-256

Waiting

Run a check with a raw body, signing secret, and signature header.

Computed digest not computed

Normalized received signature not provided

Failure checks

Verify the raw request body before JSON parsing or formatting.
Use the webhook endpoint signing secret, not an API key.
Normalize optional `sha256=` prefixes before comparing values.
Use timing-safe comparison in the server route.

Next assets

Download the free sample Fixture, handler, signature test, contract test, replay test, and CI skeleton. Preview the CNY 69 Pro Kit 29 files, 12 tests, provider fixtures, route handlers, and review templates. Check package and checkout status Manifest hash, sample digest, sitemap, health checks, and checkout readiness.

Guide Next.js raw body webhook signature checks

Debugger Fix invalid Lemon Squeezy x-signature errors

Test suite Generate webhook contract tests