generated webhook handler compared a hex digest to base64 - verification failed on every delivery and events were...

Match the digest encoding to what the provider sends: if the signature header is base64, compare against a base64-encoded digest, not hex. Check the docs for the exact encoding and header format - some providers prepend a scheme prefix - then encode your computed digest the same way. Verification starts passing as soon as both sides speak the same encoding.

generated webhook handler compared a hex digest to base64  -  verification failed on every delivery and events were dropped

Steps

1. Read the provider's webhook docs for the signature header format: hex or base64 encoding, and whether the header carries a prefix naming the scheme. Expected: You can state the documented encoding and any header prefix in one sentence.

2. Log one incoming signature header next to your computed digest and confirm the mismatch is encoding: hex digests use only 0-9 and a-f, base64 uses a larger alphabet plus padding characters. Expected: The side-by-side comparison confirms an encoding mismatch rather than a wrong secret.

3. Encode your computed digest the same way the provider does, and handle the prefix exactly as documented: strip it before comparing or include it in your formatted digest, whichever the docs describe. Expected: Your digest and the header now use the same encoding and prefix handling.

4. Re-send a test event and confirm verification passes, then watch production deliveries to confirm events stop being dropped. Expected: Computed digest and header match; test webhooks verify and events stop being dropped.

Use this when

• signature verification fails on every single delivery
• the computed digest and the header look like different alphabets
• the provider docs name a specific digest encoding

Not for this skill when

• verification fails even with matching encodings - check the raw body handling
• the secret itself is wrong, for example the API key used instead of the signing secret
• signatures pass but timestamp checks fail - that is a tolerance problem

Variant phrasings

webhook signature encoding mismatch

hex vs base64 HMAC

signature verification fails every delivery

digest encoding wrong webhook

Why it happens

Hex and base64 are just two ways to write the same bytes, but a comparison across encodings can never match: the character sets do not overlap enough for even one digest to compare equal. The cruel part is that the failure looks identical to a wrong-secret failure, so debugging goes down the wrong path - rotating secrets, re-reading dashboards - while the real bug is one encoding function.

Edge cases

• Some providers hex-encode but uppercase the digits - normalize case before comparing
• Prefixes naming the scheme must be handled before comparing, never ignored silently
• If the provider publishes a sample signature for a sample payload, verify your code against it first
• Keep a test that computes a signature for a fixed payload and asserts the exact expected header value

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Tj5KH3NE-8wMUB4mQQv6hQ