Verify first. Process once.

The sandbox creates a signed test event with an event ID, timestamp, payload and HMAC-SHA-256 signature. It lets you test your verifier without pretending that a production delivery channel exists.

Test webhook Read endpoint

Sandbox contract

A test for your verifier — not production delivery.

The endpoint returns a canonical payload and verification data. It does not call an arbitrary URL and carries no Clarity Account data.

Event ID: Stable UUID for recognising repeated processing.
Timestamp: Signed Unix timestamp; your server applies a narrow acceptance window.
Signature: HMAC-SHA-256 over the exact documented bytes.
Idempotency: One event ID causes at most one domain effect in your system.
Boundary: No registration of external production destinations, no user or health data, and no guaranteed ordering.
Observability: Request ID, project and daily error count remain traceable in the Developer Workspace.

verification-order.txt

read raw body
check signed timestamp window
compute HMAC-SHA-256
compare in constant time
deduplicate event id
process exactly once