# Webhook Signature Validator (`junipr/webhook-signature-validator`) Actor Validate webhook payload signatures against HMAC-style schemes and return pass/fail details. - **URL**: https://apify.com/junipr/webhook-signature-validator.md - **Developed by:** [junipr](https://apify.com/junipr) (community) - **Categories:** Developer tools, E-commerce - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $4.90 / 1,000 request or schema checkeds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Webhook Signature Validator ### Store Positioning **Store title:** Webhook Signature Validator **Short description:** Validate webhook payload signatures against HMAC-style schemes and return pass/fail details. **SEO title:** Webhook Signature Validator — API, schema, and developer QA **SEO description:** Validate webhook payload signatures against HMAC-style schemes and return pass/fail details. Use it to catch contract drift, schema mistakes, unsafe endpoint assumptions, and developer-tool quality issues before release. **Categories:** DEVELOPER_TOOLS, ECOMMERCE **Keywords:** webhook, signature, validator, web audit, api/developer qa ### Fixed-Inclusive PPE Pricing This actor uses pay-per-event pricing. Event prices include Apify platform usage; users are not expected to pay a separate platform-usage pass-through charge for the configured pricing model. - Tier: A1 — API/developer QA - Primary event: `signature-validated` at $0.00650 base - Default max charge: $10.00 - Store discounts: FREE/BRONZE base, SILVER discounted, GOLD deepest approved discount Event set: - `actor-start`: base $0.00500, GOLD $0.00400. Webhook Signature Validator: charged when actor start is completed. The price includes Apify platform usage; no separate usage pass-through is intended. - `signature-validated`: base $0.00650, GOLD $0.00520. Webhook Signature Validator: charged when signature validated is completed. The price includes Apify platform usage; no separate usage pass-through is intended. - `contract-rule-checked`: base $0.00390, GOLD $0.00312. Webhook Signature Validator: charged when contract rule checked is completed. The price includes Apify platform usage; no separate usage pass-through is intended. - `report-generated`: base $0.05000, GOLD $0.04000. Webhook Signature Validator: charged when report generated is completed. The price includes Apify platform usage; no separate usage pass-through is intended. ### Public Task Concepts - Validate Webhook Signature records from a capped sample - Find invalid Webhook Signature values before delivery - Check Webhook Signature coverage against expected rules - Prioritize Webhook Signature validation failures by severity - Export Webhook Signature pass-fail rows with evidence ### What It Does Validate webhook payload signatures against HMAC-style schemes and return pass/fail details. This local package is part of the Junipr Apify actors 171-200 premium build for ChatGPT review. ### What It Does Not Do - It does not call live Apify APIs. - It does not publish, upload Store assets, create public tasks, or configure live PPE. - It does not claim publish readiness. - It does not make unbounded network calls in the supplied examples path. ### Input Fields Seed shape: inputItems, maxItems, includeReport The tiny fixture is available at `examples/input.tiny.json` and mirrored at `fixtures/input.tiny.json` for the local runner. ### Output Fields - `validationId` - `algorithm` - `signatureProvided` - `signatureComputedMasked` - `isValid` - `timestampValid` - `payloadHash` - `mismatchReason` ### Public Task Examples #### Validate webhook HMAC signatures from sample payloads - Search intent: validate webhook hmac signatures from sample payloads - Specific input: Fixture input shaped for validate webhook hmac signatures from sample payloads. - Expected output: Dataset rows with validationId, algorithm, signatureProvided, signatureComputedMasked plus local KVS report evidence. - Why run it: API teams, integration engineers, SaaS developers would run this to get a bounded local proof before any live Apify review or production use. #### Mask computed webhook secrets in QA output - Search intent: mask computed webhook secrets in qa output - Specific input: Fixture input shaped for mask computed webhook secrets in qa output. - Expected output: Dataset rows with validationId, algorithm, signatureProvided, signatureComputedMasked plus local KVS report evidence. - Why run it: API teams, integration engineers, SaaS developers would run this to get a bounded local proof before any live Apify review or production use. #### Compare provided and computed webhook signatures - Search intent: compare provided and computed webhook signatures - Specific input: Fixture input shaped for compare provided and computed webhook signatures. - Expected output: Dataset rows with validationId, algorithm, signatureProvided, signatureComputedMasked plus local KVS report evidence. - Why run it: API teams, integration engineers, SaaS developers would run this to get a bounded local proof before any live Apify review or production use. #### Check timestamp and payload hash evidence locally - Search intent: check timestamp and payload hash evidence locally - Specific input: Fixture input shaped for check timestamp and payload hash evidence locally. - Expected output: Dataset rows with validationId, algorithm, signatureProvided, signatureComputedMasked plus local KVS report evidence. - Why run it: API teams, integration engineers, SaaS developers would run this to get a bounded local proof before any live Apify review or production use. #### Prepare webhook signature fixtures for integration tests - Search intent: prepare webhook signature fixtures for integration tests - Specific input: Fixture input shaped for prepare webhook signature fixtures for integration tests. - Expected output: Dataset rows with validationId, algorithm, signatureProvided, signatureComputedMasked plus local KVS report evidence. - Why run it: API teams, integration engineers, SaaS developers would run this to get a bounded local proof before any live Apify review or production use. ### Tests - Actor-specific fixture tests live in `test/webhook-signature-validator.test.ts`. - Node-based local suites validate dataset schema conformance, output samples, local smoke runs, and PPE guard behavior. ### FAQ #### Is this live on Apify? No. This is a local package for ChatGPT review only. #### Is it publish-ready? No. It needs later live tiny-run validation and console configuration before any publication decision. # Actor input Schema ## `inputItems` (type: `array`): Actor-specific records or URLs to process. ## `domains` (type: `array`): Domain fixture records or domain strings. ## `urls` (type: `array`): URL fixture records or URL strings. ## `maxItems` (type: `integer`): Hard cap for processed items. ## `maxDomains` (type: `integer`): Hard cap for processed domains. ## `timeoutMs` (type: `integer`): Local/live request timeout cap in milliseconds. ## `includeReport` (type: `boolean`): Write KVS Markdown and JSON report outputs. ## `includeSummary` (type: `boolean`): Write summary KVS output. ## `strictMode` (type: `boolean`): Use stricter validation thresholds. ## `fixtureMode` (type: `boolean`): Use local deterministic fixtures. Live lookups remain off by default. ## `maxChargeUsd` (type: `number`): Local PPE guard cap before paid rows stop gracefully. ## Actor input object example ```json { "maxItems": 50, "maxDomains": 50, "timeoutMs": 5000, "includeReport": true, "includeSummary": true, "strictMode": false, "fixtureMode": true, "maxChargeUsd": 1 } ```` # Actor output Schema ## `dataset` (type: `string`): Structured rows emitted by the actor. ## `report` (type: `string`): Run summary report stored in the default key-value store. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("junipr/webhook-signature-validator").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("junipr/webhook-signature-validator").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call junipr/webhook-signature-validator --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=junipr/webhook-signature-validator", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Webhook Signature Validator", "description": "Validate webhook payload signatures against HMAC-style schemes and return pass/fail details.", "version": "1.0", "x-build-id": "jUNkgH7x6IQnij47f" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/junipr~webhook-signature-validator/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-junipr-webhook-signature-validator", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/junipr~webhook-signature-validator/runs": { "post": { "operationId": "runs-sync-junipr-webhook-signature-validator", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/junipr~webhook-signature-validator/run-sync": { "post": { "operationId": "run-sync-junipr-webhook-signature-validator", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "inputItems": { "title": "Input items", "type": "array", "description": "Actor-specific records or URLs to process." }, "domains": { "title": "Domains", "type": "array", "description": "Domain fixture records or domain strings." }, "urls": { "title": "URLs", "type": "array", "description": "URL fixture records or URL strings." }, "maxItems": { "title": "Maximum items", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Hard cap for processed items.", "default": 50 }, "maxDomains": { "title": "Maximum domains", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Hard cap for processed domains.", "default": 50 }, "timeoutMs": { "title": "Timeout per item", "minimum": 500, "maximum": 60000, "type": "integer", "description": "Local/live request timeout cap in milliseconds.", "default": 5000 }, "includeReport": { "title": "Include report", "type": "boolean", "description": "Write KVS Markdown and JSON report outputs.", "default": true }, "includeSummary": { "title": "Include summary", "type": "boolean", "description": "Write summary KVS output.", "default": true }, "strictMode": { "title": "Strict mode", "type": "boolean", "description": "Use stricter validation thresholds.", "default": false }, "fixtureMode": { "title": "Fixture mode", "type": "boolean", "description": "Use local deterministic fixtures. Live lookups remain off by default.", "default": true }, "maxChargeUsd": { "title": "Maximum charge USD", "minimum": 0.01, "maximum": 100, "type": "number", "description": "Local PPE guard cap before paid rows stop gracefully.", "default": 1 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```