How it works
Every webhook delivery from a monitor carries an Onekey-Signature header shaped like t=<unix seconds>,v1=<hex>. The v1 value is the HMAC-SHA256 of the text <t>. followed by the raw request body, keyed with the webhook secret shown once when the monitor was created or last rotated. A receiver recomputes it, compares in constant time, and refuses a t more than 300 seconds from its own clock. This page does those same steps with your browser's Web Crypto, following the reference verifier in the monitors documentation.
Nothing you paste leaves this page: there is no request to any server, and it works offline. Even so, prefer a throwaway monitor or the generated test vector over a production secret. When a check fails, the result says which step broke and looks for the usual causes: the wrong or a rotated secret, a body that was edited, trimmed or re-serialised (verify the raw bytes, not parsed JSON), a header from a different attempt (every retry is signed again with a new t), or a clock that is off.