Other providers (Generic)

Not every provider gets a dedicated verifier, but most webhook signatures share one shape. The Generic provider verifies that shape against a header and secret you configure — so a provider that isn’t Stripe, GitHub, or Shopify can still be verified, with no code from you.

What the Generic verifier does

Pick the Generic provider on an endpoint and give it two things: the name of the signature header your provider sends, and an optional static prefix on that header’s value (like sha256=). On every delivery catchbin then computes:

expected = HMAC_SHA256(your_secret, raw_body)   // hex-encoded

and compares it, byte for byte, against the header value (with the prefix stripped first). The digest is hex, and the signed message is the raw request body exactly as received — the same byte-level comparison every provider verifier uses, which is why most failures are byte-level differences rather than a wrong secret. See Verify signatures.

Does your provider fit?

The Generic verifier matches one common scheme. Check your provider’s signing docs against it.

It fits when the signature is:

• HMAC-SHA256, and
• hex-encoded, and
• computed over the raw body (nothing else), and
• delivered in a single header, optionally behind a fixed prefix.

It does not fit (yet) when the scheme uses:

• a base64-encoded digest instead of hex,
• a timestamp or basestring — the provider signs {timestamp}.{body} or similar, not the body alone,
• URL or query canonicalization — the signed message includes the request URL or sorted parameters,
• a signature carried inside the JSON payload rather than a header,
• an asymmetric (public-key) signature — Ed25519, RSA, ECDSA, JWT/JWKS.

Note

If your provider’s scheme is on the “does not fit” list, catchbin can still capture, inspect, forward, and replay its webhooks — you just won’t get signature verification until a dedicated verifier ships. Nothing about capture depends on the provider being verifiable.

Configure a Generic endpoint

In the dashboard, create an endpoint, choose the Generic provider, then set the signature header name and, if your provider uses one, the prefix. Paste your provider’s signing secret; catchbin stores it encrypted and never shows it again.

Or over the public API with the CLI:

catchbin api endpoints create --slug my-provider \
    --signature-header X-Provider-Signature \
    --signature-prefix sha256=

--signature-prefix is optional — omit it when the header value is the bare hex digest with nothing in front.

Providers that work today

These providers sign with plain HMAC-SHA256 hex over the raw body, so they verify with the Generic provider now — just point it at the header (and prefix, where there is one).

Provider	Signature header	Prefix
Bitbucket	X-Hub-Signature	sha256=
Coinbase Commerce	X-CC-Webhook-Signature	—
Razorpay	X-Razorpay-Signature	—
Linear	Linear-Signature	—
Sentry	Sentry-Hook-Signature	—
Lemon Squeezy	X-Signature	—
Checkout.com	Cko-Signature	—
Dwolla	X-Request-Signature-SHA-256	—
Mollie (next-gen signing)	X-Mollie-Signature	sha256=
GitLab (signing token)	X-Gitlab-Signature	—

Tip

GitLab has two modes. The classic X-Gitlab-Token is a plain shared-secret string in a header — nothing is hashed, so there is no signature to verify. Its newer signing token emits an HMAC-SHA256 hex digest over the body, which is what the Generic provider verifies. Use the signing token.

When verification fails

A Generic endpoint reports the same diagnostic branches as the built-in providers. Match the branch to the fix:

What catchbin reports	Cause	Fix
Secret missing	No signing secret stored on the endpoint	Paste the provider’s secret
Header missing	The configured header wasn’t on the request	Confirm the header name matches exactly (case-insensitive)
Header malformed	The value didn’t start with the configured prefix, or wasn’t valid hex	Check the prefix, and that the provider sends hex (not base64)
Signature mismatch	Digest computed, but didn’t match	Usually the body was mutated in transit, or the secret is wrong — compare byte counts first

A signature mismatch on a Generic endpoint almost always means the body changed before it reached the verifier (a middleware, a re-serialization, an added newline) or the secret is wrong — the same first suspects as any provider. See Verify signatures for the full diagnostic.

Replay

You can replay a captured Generic event to any target. --strip drops the signature header for a target that doesn’t verify. First-class re-signing (--resign) is not available for Generic — catchbin re-signs only for Stripe, GitHub, and Shopify, whose schemes it can reconstruct.