Pusher signature checker

Find out why you get “Invalid signature” or AuthError: work out the signature for a private or presence channel, a user sign-in, a webhook or an HTTP API request, and compare it with yours. It works for Hibira, Pusher and any Pusher-compatible server.

App keyThe public key, not the secret.App secret

Socket IDFrom pusher:connection_established, or socket_id in the request to your auth endpoint.Channel nameauth value to check (optional)What your endpoint returned as auth, such as APP_KEY:abc123….

Result

Fill in the fields above: the result updates as you type.

How Pusher signatures work

Private channels: HMAC-SHA256 of socket_id:channel_name, keyed with the app secret. The auth value is the app key, a colon and the hex signature.
Presence channels: the same, over socket_id:channel_name:channel_data.
User sign-in: the same, over socket_id::user::user_data.
Webhooks: HMAC-SHA256 of the raw body, in the X-Pusher-Signature header.
HTTP API: HMAC-SHA256 of the method, the path and the sorted query (without auth_signature), one per line; a body adds its MD5 as body_md5.

WebSocket close codes and Pusher error codes → · The Pusher protocol, explained →