verify_webhook
Read-onlyIdempotent
Verify a webhook's HMAC-SHA256 signature locally and return a valid/invalid verdict to confirm the payload is authentic before trusting payment events.
Instructions
Check a webhook's HMAC-SHA256 signature and return only a valid/invalid answer.
Prefer `parse_webhook` for an incoming delivery — it verifies the signature *and*
extracts the payment status, event ID and a paid/not-paid verdict in one call.
Reach for this tool only when the boolean alone is what you need.
Runs locally; makes no network call. Treat a `valid: false` result as an attack
or a misconfiguration and ignore the payload — an unverified "payment complete"
event is exactly how someone gets a book without paying.
Pass the body exactly as received; the digest covers the raw request bytes, so
re-serialising the JSON breaks it. Secrets are per link, not per account. This
errors instead of answering when no signature or secret is available, or when the
secret falls outside Wayl's 10-255 characters — one that short cannot have signed
a real delivery.
`valid: true` does not mean the event is new. There is no timestamp or nonce, so a
captured delivery verifies forever. Deduplicate on the payload's `id`.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| secret | No | The webhookSecret for this link. Defaults to WAYL_WEBHOOK_SECRET. | |
| headers | No | The webhook's request headers. The signature header is found automatically, so you can pass the whole map instead of extracting it. | |
| raw_body | Yes | The webhook request body exactly as received, byte for byte. Do not reformat or re-serialise it — that changes the signature. | |
| signature | No | Signature from the webhook's signature header. Omit if you pass `headers` instead. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||