API Reference

Signature verifier

Paste your signing secret, the raw request body, and the X-JE-Signature header. We compute the HMAC client-side and tell you whether your receiver would accept it. Your secret never leaves the browser — no fetch, no telemetry.

Signing secret (whsec_…) Raw request body Raw bytes as your receiver would see them, BEFORE any JSON.parse. Whitespace matters. X-JE-Signature header value Format: t=<unix>,v1=<hex>.

What this checks

The header parses as t=<unix>,v1=<hex>.
t is within ±300s of "now" — defends against replay attacks.
v1 === HMAC-SHA256(secret, t + "." + body), compared in constant time.

Mirrors the server-side helper at backend/internal/handlers/webhook_outgoing.go::VerifyWebhookSignature. See the receiver recipe for Node + Python + Go code.