HMAC (RFC 2104) proves a message came from someone holding the key and was not altered. Webhook signatures (GitHub, Stripe, Slack) are HMAC-SHA256 over the raw request body. Use the exact bytes you received: re-serialised JSON will not match. Don't paste a production secret into any website; use a test key.