401 / 403 and webhook troubleshooting

API Auth Debugger

Check JSON bodies, diagnose JWT timing issues, and verify HMAC-SHA256 signatures.

Tokens, request bodies, and secrets stay in this browser and are never uploaded.

Module A

JSON Request Body

JSON input

Formatted output

Run Beautify / Minify to see output here.

Module B

JWT token

This decodes and diagnoses claims. It does not claim the signature is valid without a key.

Module C

Verification presetSecret Raw message bodyReceived signature (optional)

Locally calculated expected signature

Provide a secret to generate or verify a signature.

Signature mismatch: check the secret, raw body, encoding, prefix, and newlines.

Diagnostic artifact

Complete any check to build a copyable diagnosis here.