Eight Webhook Providers, Four Hidden Ways They Each Sign Requests Differently

A developer integrating webhooks across Stripe, GitHub, Shopify, Slack, Paddle, Twilio, Telegram, and Standard Webhooks documented key differences in how each provider signs and verifies requests. While most use HMAC-SHA256, they diverge on encoding (hex vs. base64), timestamp validation windows, and exactly what data gets signed. Twilio stands out as the biggest outlier, using the older SHA-1 algorithm and signing the request URL rather than the payload, requiring an extra body digest check for JSON deliveries. Stripe and Standard Webhooks share a visually identical secret prefix but decode their keys differently, causing silent verification failures if confused. A common pitfall across all providers is framework-level JSON re-parsing, which can strip whitespace or reorder keys and silently invalidate signatures before verification even begins.