Check a Xaalis webhook signature
Paste what your server received. If the signature fails, the tool tells you why.
Everything is computed in your browser: nothing you type is sent anywhere.
How it is calculated
The header reads t=<timestamp>,v1=<signature>. The signature is a hex HMAC-SHA256 of “<t>.<raw body>” keyed with your webhook secret. Several v1 values may be present: one must match.
The body must be the exact bytes received. JSON parsed and serialized again, or a space or newline added while copying, is enough to change the signature.
A notification older than 5 minutes is refused, to stop replays. To check a body copied from the delivery log, untick the 5-minute window.
The computation runs in your browser with Web Crypto: your secret is sent nowhere. Prefer your test secret.
Other tools
- Price to chargeMerchantsThe price to show so you receive exactly what you want, after the Xaalis fee.
- Amount in wordsMerchantsAn amount in CFA francs written out in full, for invoices, receipts and cheques.
- VAT calculatorMerchantsNet, VAT and gross at 18 % (or your rate), rounded to the franc, with the total in words.
Accept Wave and Orange Money
One API, one checkout page, 1.5 % per successful payment. The test account is free.