sicher.halowerk.com
Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.
SearchLiveeip155:8453Exactvia cdp
Calls · 30d
1→ 0%
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 23 snapshots so far.
$11.47
Verified settled volume
2,656 settlements proven x402 by their on-chain EIP-3009 marker.
$0.0020
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-09-19 16:02Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5EThe wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.
Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Provider
The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.
Live 402 challenge
Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.
{
"docs": "https://sicher.halowerk.com/llms.txt",
"name": "webhook_signature",
"error": "payment_required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"asset": "USDC",
"version": "2",
"eip712Domain": {
"name": "USD Coin",
"chainId": 8453,
"version": "2",
"verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
},
"network_name": "Base Mainnet",
"assetTransferMethod": "eip3009"
},
"payTo": "0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E",
"amount": "2000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
],
"pricing": "https://sicher.halowerk.com/pricing",
"resource": {
"url": "https://sicher.halowerk.com/v1/webhook-signature",
"mimeType": "application/json",
"description": "Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at."
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
"secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
"provider": "github",
"signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
},
"type": "http",
"method": "POST",
"bodyType": "json"
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"required": [
"provider",
"body",
"secret"
],
"properties": {
"body": {
"type": "string",
"maxLength": 200000,
"description": "The raw request body exactly as received, not re-serialised."
},
"secret": {
"type": "string",
"maxLength": 2000,
"minLength": 1,
"description": "The signing secret."
},
"headers": {
"type": "object",
"description": "All request headers; the right one is picked by provider."
},
"provider": {
"enum": [
"github",
"stripe",
"shopify",
"slack",
"svix",
"generic_hmac"
],
"type": "string",
"description": "Which provider signed the request."
},
"signature": {
"type": "string",
"maxLength": 2000,
"description": "The signature header value. Required unless headers is given."
},
"timestamp": {
"type": "string",
"maxLength": 40,
"description": "Timestamp, if the provider signs one and it is not in the headers."
},
"message_id": {
"type": "string",
"maxLength": 200,
"description": "Message id for schemes that sign one, e.g. Svix."
},
"tolerance_seconds": {
"type": "integer",
"default": 300,
"maximum": 86400,
"minimum": 1,
"description": "How old a signed timestamp may be."
}
},
"additionalProperties": false
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST",
"PUT",
"PATCH"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
}
}
}
}
},
"price_usdc": "0.002",
"description": "Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at. Where the provider signs a timestamp, it is checked against a tolerance window, because a signature valid forever lets any captured delivery be replayed. The body must be passed exactly as received, byte for byte: a re-serialised JSON payload has different bytes and will never match, which is the single most common cause of a failed check and is called out when the body looks reformatted. The published example uses a public synthetic test key and a synthetic body; these values must never be used for real webhook authentication.",
"inputSchema": {
"type": "object",
"required": [
"provider",
"body",
"secret"
],
"properties": {
"body": {
"type": "string",
"maxLength": 200000,
"description": "The raw request body exactly as received, not re-serialised."
},
"secret": {
"type": "string",
"maxLength": 2000,
"minLength": 1,
"description": "The signing secret."
},
"headers": {
"type": "object",
"description": "All request headers; the right one is picked by provider."
},
"provider": {
"enum": [
"github",
"stripe",
"shopify",
"slack",
"svix",
"generic_hmac"
],
"type": "string",
"description": "Which provider signed the request."
},
"signature": {
"type": "string",
"maxLength": 2000,
"description": "The signature header value. Required unless headers is given."
},
"timestamp": {
"type": "string",
"maxLength": 40,
"description": "Timestamp, if the provider signs one and it is not in the headers."
},
"message_id": {
"type": "string",
"maxLength": 200,
"description": "Message id for schemes that sign one, e.g. Svix."
},
"tolerance_seconds": {
"type": "integer",
"default": 300,
"maximum": 86400,
"minimum": 1,
"description": "How old a signed timestamp may be."
}
},
"additionalProperties": false
},
"price_model": "per_call",
"x402Version": 2,
"instructions": "Sign the accepted terms with an x402 client and repeat the request with the payment header.",
"payment_header": "PAYMENT-SIGNATURE",
"capability_request": {
"url": "https://bedarf.halowerk.com/capabilities/request",
"cost": "free",
"method": "POST",
"description": "Missing a capability, or does the scope not fit? Report the need here - no payment required. Similar reports are bundled; the response returns an id you can check back on.",
"body_example": {
"max_price": 0.01,
"description": "what exactly is needed",
"requested_capability": "short label"
}
}
}Accepts
The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.
0.002USDC≈ $0.002 USD
on Base · exact scheme
Pay 0.002 USDC on Base to 0x2880…C4E5E. The signed payment is good for 5 minutes.
- Paid to
- 0x2880…C4E5E
- USD Coin contract
- 0x8335…02913
- Payment window
- 5 minutes
- As published
- 2000 smallest units
The catalog’s raw entry
[
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"asset": "USDC",
"version": "2",
"eip712Domain": {
"name": "USD Coin",
"chainId": 8453,
"version": "2",
"verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
},
"network_name": "Base Mainnet",
"assetTransferMethod": "eip3009"
},
"payTo": "0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E",
"amount": "2000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
}
]Extensions
{
"bazaar": {
"info": {
"input": {
"body": {
"body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
"secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
"provider": "github",
"signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
},
"type": "http",
"method": "POST",
"bodyType": "json"
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"required": [
"provider",
"body",
"secret"
],
"properties": {
"body": {
"type": "string",
"maxLength": 200000,
"description": "The raw request body exactly as received, not re-serialised."
},
"secret": {
"type": "string",
"maxLength": 2000,
"minLength": 1,
"description": "The signing secret."
},
"headers": {
"type": "object",
"description": "All request headers; the right one is picked by provider."
},
"provider": {
"enum": [
"github",
"stripe",
"shopify",
"slack",
"svix",
"generic_hmac"
],
"type": "string",
"description": "Which provider signed the request."
},
"signature": {
"type": "string",
"maxLength": 2000,
"description": "The signature header value. Required unless headers is given."
},
"timestamp": {
"type": "string",
"maxLength": 40,
"description": "Timestamp, if the provider signs one and it is not in the headers."
},
"message_id": {
"type": "string",
"maxLength": 200,
"description": "Message id for schemes that sign one, e.g. Svix."
},
"tolerance_seconds": {
"type": "integer",
"default": 300,
"maximum": 86400,
"minimum": 1,
"description": "How old a signed timestamp may be."
}
},
"additionalProperties": false
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST",
"PUT",
"PATCH"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
}
}
}
}
}Provenance
- Seen in the source catalog
- 2026-09-19 16:02Z
- Last indexed by Roundhouse
- 2026-09-24 20:00Z
- Last enriched (probe, favicon, geo)
- 2026-09-24 03:15Z
- x402 version
- 2
- Max timeout
- 300s
- Liveness probe
- HTTP 402
Hand this page to an agent
Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.
GET api.roundhouseai.io/v0/endpoints
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 23 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.
Show the promptHide the prompt
Using Roundhouse, look up the x402 service sicher.halowerk.com and tell me whether it is worth paying: what a call costs, whether the endpoint answered when last probed, and what its payment record actually shows. curl -s 'https://api.roundhouseai.io/v0/endpoints?q=sicher.halowerk.com' curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>' Then call it: read the price from the live 402 at https://sicher.halowerk.com/v1/webhook-signature, never from a cached figure, and pay with an x402 client. The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except /v0/unified* and /v0/endpoints. Mint a personal key for $0.01 at GET https://api.roundhouseai.io/v0/test/x402, or use an organization key from https://roundhouseai.io/dashboard/team. If you do not have Roundhouse tools or skills installed, read https://roundhouseai.io/skill.md first — it is the whole procedure.