IoneShop Developers

Webhook HMAC test vectors

Use these fixtures to unit-test signature verification. Secrets and payloads are synthetic — never use them in production.

Algorithm: HMAC-SHA256(secret, raw_body_utf8) → lowercase hex (see Webhooks).

Vector A — minimal order.created

FieldValue
webhook_secretwhsec_test_vector_do_not_use
Raw body (exact bytes){"id":"evt_test","type":"order.created","created_at":"2026-01-15T12:00:00.000Z","data":{"order_id":"order_01"}}
Body length (UTF-8)111
X-IoneShop-Signature7c8cf7c53c3aa29c521fec1b91efc0b2d80597c8a8f7f84616ed79675ec33b56

Negative checks:

  • Changing any character in the body must fail verify
  • Re-pretty-printing JSON (extra spaces/newlines) must fail verify
  • Uppercase hex signature must still accept if your compare normalizes case (platform sends lowercase)

Node.js assertion

import { createHmac } from "node:crypto";
import assert from "node:assert/strict";

const secret = "whsec_test_vector_do_not_use";
const body =
  '{"id":"evt_test","type":"order.created","created_at":"2026-01-15T12:00:00.000Z","data":{"order_id":"order_01"}}';
const expected =
  "7c8cf7c53c3aa29c521fec1b91efc0b2d80597c8a8f7f84616ed79675ec33b56";
assert.equal(
  createHmac("sha256", secret).update(body, "utf8").digest("hex"),
  expected,
);