Recompute an HMAC signature locally and compare it with the one you received.
Verify an HMAC webhook signature the way the provider computes it. The most common cause of a mismatch is hashing a re-serialized body instead of the exact raw bytes that arrived.
Never leaves your browser. The signing secret is used by the browser's Web Crypto API in this tab. It is never uploaded, never stored, never written to a share URL, and never appears in Copy Findings.
Paste the body exactly as received. Reformatting the JSON changes the bytes and therefore the signature.