Signed, Sealed, Mangled: Why Webhook Signatures Fail Behind a Tunnel
You point a tunnel at localhost:3000 , send a test event, and your handler answers 400 Invalid signature . The payload looks right. The secret looks right. So why does webhook signature verification fail only when the request passes through a tunnel or reverse proxy? A signature is a promise about exact bytes, exact timing and, for some providers, an exact URL. A tunnel, proxy or helpful middleware can change any of those while the request still looks healthy. This guide covers the three failure families developers hit most: raw body versus re-serialized JSON, timestamp tolerance, and Twilio-style signing of the full URL. It ends with a debugging checklist and a look at the debugging tools available as of November 2026. How webhook signatures work Nearly every provider uses an HMAC: the sender combines a shared secret with some “signed content,” hashes it, and puts the result in a header. The receiver rebuilds the same content, computes its own HMAC and compares the two in constan...
