ForHosting KIT · Developer Utilities

Sign and verify webhooks

Anyone can send a POST request to your endpoint claiming to be a trusted partner, and anyone downstream can claim your webhook never arrived. This endpoint puts a cryptographic signature on outgoing payloads and checks incoming ones, so both sides can prove what was actually sent and that nothing was altered in transit.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

The problem an unsigned webhook creates

An endpoint that accepts any POST body as truth is an endpoint anyone can spoof — a fake payment-succeeded event, a forged order update, a replayed request from a captured payload. And on the sending side, without a signature to point to, a partner can dispute that you ever sent an event at all, leaving a support ticket with no way to settle it. dev.webhook_sign exists because 'trust the payload' stopped being a viable security model the moment webhooks became load-bearing infrastructure.

Two directions, one endpoint

Send POST /dev/webhook-sign with a payload and an intent to sign, and the task returns a signature you attach to the outgoing request headers before delivery. Send the same endpoint an incoming payload with its received signature and a verification intent, and it checks the signature against the payload and reports whether it's valid, tampered, or expired. Either way you get a task_id immediately, and the result — a signature or a verification verdict — arrives by signed webhook or a signed link valid for 24 hours.

Why signing is not the same as encryption

A signature doesn't hide the payload — it proves who sent it and that it wasn't changed after signing, using a shared secret or key pair and a hash of the message content. This is the same principle behind HMAC-signed webhooks that major platforms have used for over a decade: the receiver recomputes the signature from the raw payload and compares it to what arrived, and any mismatch means something was altered, delayed past a timestamp window, or never actually sent by the claimed source.

Fitting signature checks into a real pipeline

A webhook receiver that verifies before it processes closes off an entire class of spoofing attempts without adding meaningful latency, since the check itself is fast and priced as a flat $0.002 per request with nothing charged on failure. Teams running many webhook integrations tend to route every inbound payload through verification as a first automated step, rejecting anything that fails before it ever reaches business logic — the same discipline applied on the outbound side means every partner receiving your webhooks can independently confirm they're really from you.

What you can do with it

Outbound webhook authenticity

A SaaS platform signs every webhook it sends to customers so those customers can verify the event genuinely originated from the platform before acting on it.

Inbound payment webhook verification

An online store verifies the signature on every incoming payment-status webhook before updating an order, rejecting anything that fails the check.

Partner API mutual trust

Two companies exchanging webhooks in both directions sign what they send and verify what they receive, closing the loop on disputes about missing or altered events.

Replay attack prevention

A fintech integration verifies both the signature and a timestamp window on incoming webhooks, rejecting valid-looking payloads that arrive too long after they were signed.

FAQ

How do I sign or verify a webhook with this API?

POST the payload and an intent to sign or verify to /dev/webhook-sign, keep the returned task_id, and collect the signature or verification result by webhook or a signed link valid for 24 hours.

Is the webhook signature API free?

No, there is no free tier or trial; it costs a flat $0.002 per request, and a failed task is never charged.

What's the difference between signing and encrypting a webhook?

Signing proves who sent the payload and that it wasn't altered, while leaving the content readable; it does not hide the payload the way encryption would.

Can it verify webhooks from any provider?

It verifies against the signature scheme and secret or key you provide with the request, so it works with any provider whose signing method you can supply.

Does it protect against replayed webhooks?

Verification can include a timestamp check alongside the signature, so a payload replayed well after its signing window is flagged even if the signature itself is technically valid.

Can I sign or verify webhooks in bulk?

Yes, submit one async task per payload and collect each result by webhook as it completes, which suits high-volume outbound or inbound traffic.

What happens if a signature doesn't match?

The verification result reports the mismatch clearly rather than silently passing, so your pipeline can reject the payload before it reaches business logic.

Is this endpoint live?

Yes, /dev/webhook-sign is live and accepting requests now.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/webhook-sign

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/webhook-sign \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"input":"…"}'

const res = await fetch("https://api.kit.forhosting.com/dev/webhook-sign", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "input": "…"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/webhook-sign",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "input": "…"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/webhook-sign", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"input":"…"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"input":"…"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/webhook-sign", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "input": "…"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.webhook_sign",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free