Match the digest encoding to what the provider sends: if the signature header is base64, compare against a base64-encoded digest, not hex. Check the docs for the exact encoding and header format - some providers prepend a scheme prefix - then encode your computed digest the same way. Verification starts passing as soon as both sides speak the same encoding.

```text
generated webhook handler compared a hex digest to base64  -  verification failed on every delivery and events were dropped
```

## Steps

1. Read the provider's webhook docs for the signature header format: hex or base64 encoding, and whether the header carries a prefix naming the scheme.
   Expected: You can state the documented encoding and any header prefix in one sentence.

2. Log one incoming signature header next to your computed digest and confirm the mismatch is encoding: hex digests use only 0-9 and a-f, base64 uses a larger alphabet plus padding characters.
   Expected: The side-by-side comparison confirms an encoding mismatch rather than a wrong secret.

3. Encode your computed digest the same way the provider does, and handle the prefix exactly as documented: strip it before comparing or include it in your formatted digest, whichever the docs describe.
   Expected: Your digest and the header now use the same encoding and prefix handling.

4. Re-send a test event and confirm verification passes, then watch production deliveries to confirm events stop being dropped.
   Expected: Computed digest and header match; test webhooks verify and events stop being dropped.

## Use this when

- signature verification fails on every single delivery
- the computed digest and the header look like different alphabets
- the provider docs name a specific digest encoding

## Not for this skill when

- verification fails even with matching encodings - check the raw body handling
- the secret itself is wrong, for example the API key used instead of the signing secret
- signatures pass but timestamp checks fail - that is a tolerance problem

## Variant phrasings

### webhook signature encoding mismatch
### hex vs base64 HMAC
### signature verification fails every delivery
### digest encoding wrong webhook

## Why it happens

Hex and base64 are just two ways to write the same bytes, but a comparison across encodings can never match: the character sets do not overlap enough for even one digest to compare equal. The cruel part is that the failure looks identical to a wrong-secret failure, so debugging goes down the wrong path - rotating secrets, re-reading dashboards - while the real bug is one encoding function.

## Edge cases

- Some providers hex-encode but uppercase the digits - normalize case before comparing
- Prefixes naming the scheme must be handled before comparing, never ignored silently
- If the provider publishes a sample signature for a sample payload, verify your code against it first
- Keep a test that computes a signature for a fixed payload and asserts the exact expected header value

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Tj5KH3NE-8wMUB4mQQv6hQ