For developers
Webhook signature verifier
Paste the three webhook headers, the raw body and the secret, and see whether the recomputed signature matches — and whether the timestamp is still inside the tolerance window.
For developers
Try a webhook, a key or an API call without writing a script to do it first.
Free developer tools: verify a webhook signature, decode what a payload carried, generate a key, and call the ResellerHQ API from a browser with nothing installed.
10 tools
For developers
Webhook replay window checker
Decode a webhook-timestamp header into its exact UTC time and tolerance window, and check whether a clock reading falls inside or outside it.
For developers
Signing secret generator
Make a whsec_ webhook signing secret shaped exactly like ours, with its .env line, for testing a local receiver before a real endpoint exists.
For developers
Standard Webhooks payload signer
Type an id, a timestamp and a raw body, give a whsec_ secret, and get the exact webhook-id, webhook-timestamp and webhook-signature headers for it.
For developers
Webhook payload example generator
Pick one of our documented events and get a sample payload, plus the signed headers a delivery of it would carry, ready to send to a local receiver.
For developers
Idempotency key generator
Make a UUID v4 for the Idempotency-Key header, with a ready curl line and our own retry rules explained next to it.
For developers
API request builder
Pick one of our documented operations and get a ready curl, Python or Node snippet, with the real base URL and an Idempotency-Key where the operation spends money.
For developers
Postman collection generator
Get a full Postman Collection v2.1 JSON for our API, with the real base URL and a bearer-auth placeholder already set — paste it straight into Postman.
For developers
API error code explainer
Type one of our documented error codes, a bare status, or paste a whole response body, and get the exact status, message, meaning and what to change in the request.
For developers
ULID / request id decoder
Split one of our own prefixed ids, or a bare ULID, and read the exact UTC time it was minted — and say plainly when a prefix is not one of ours.