Blog
Posts about Security
Why Webhook Signature Verification Fails: Raw Body, Wrong Secret, Clock Skew, Proxies
Why webhook signature checks fail (raw body, wrong secret, hex vs base64, clock skew, proxies), how to debug it, and what Stripe, Shopify, GitHub and others sign.
Sending Webhooks from a Static IP: NAT Gateways, Proxies and Relays
Send webhooks from fixed IPs for customers with allowlists: NAT gateway, proxy and relay setups, their costs, SSRF checks, and why to keep signatures.