FractalPay webhook verifier
Paste a FractalPay webhook payload, its X-FractalPay-Signature header, and your HMAC secret. We reproduce the HMAC-SHA256 server-side and verify the embedded VAID-1 Dilithium-3 attestation. Nothing is logged. Inputs never leave the request handler.
Inputs
Not logged. Not persisted. Only used inside the request handler.
Results
Submit inputs to see verification results.
How webhook signing works
HMAC-SHA256 (transport integrity)
Every webhook is signed with HMAC-SHA256 using your FRACTALPAY_HMAC_SECRET. The signature is sent in the X-FractalPay-Signature header as sha256=….
Verifies: the request came from FractalPay infrastructure and was not modified in transit.
Compare using a constant-time function — the SDK's WebhookVerifier already does this.
VAID-1 (cryptographic attestation)
Each confirmed payment carries an attestation field signed with Dilithium-3 (NIST FIPS 204 / ML-DSA-65). The signature covers the canonical-encoded input/output hashes, agent ID, model version, and timestamp.
Verifies: the FractalAI payment-verifier agent actually attested this specific payment. Independent of transport layer.
The public key is published at /api/fractalpay/agent-key — anyone can verify without trusting FractalAI servers at signature time.