hooks.bot

hooks.bot gives you disposable webhook endpoints and a signature debugger. THE LOOP 1. create_endpoint — returns a URL like https://hooks.bot/h/{id} 2. Give that URL to the user and tell them to point their provider at it. 3. wait_for_request — blocks until something lands. Call this instead of asking the user to paste anything; it returns the captured bytes directly. 4. diagnose_signature with endpoint_id + request_id and the user's signing secret. WHAT diagnose_signature ACTUALLY DOES It does not merely check a signature. It rebuilds it across every plausible construction — body normalization, secret derivation, hash algorithm, digest encoding and signed-string layout — finds the one that reproduces the signature the provider sent, and reports which step differs from that provider's documented scheme. So a result is a proven cause, not a guess. Prefer it over reasoning about the user's code. READING THE RESULT - status "valid" means the signature verifies. Check the timestamp finding anyway: a valid signature can still be rejected for being outside the replay window. - status "diagnosed" means it does not verify and the cause was found. The first finding is the actionable one. - status "no-match" usually means the secret belongs to a different endpoint or environment, or the body was already parsed and re-serialized before you saw it — that last one cannot be undone from captured bytes. GOTCHAS WORTH KNOWING BEFORE YOU GUESS - Stripe and Svix/Standard Webhooks both issue secrets starting whsec_ and derive keys from them completely differently. Stripe uses the whole string; Svix strips the prefix and base64-decodes the rest. This is the commonest failure in the category. - Twilio signs the request URL plus sorted form fields, not the body. diagnose_signature needs the full webhook URL for Twilio. - Paddle's replay window is five seconds, not five minutes. Anything replayed from a log will trip it, and that is expected rather than the bug. Reference material is available as resources: hooks://guide for the full workflow, and hooks://providers/{provider} for any of stripe, github, svix, shopify, slack, paddle, twilio.