Skip to main content

@rtorcato/api-webhooks-express v0.1.0

Interfaces​

WebhookOptions​

Defined in: index.ts:5

Extends​

  • unknown

Properties​

secret​

secret: string

Defined in: index.ts:7

Shared secret used to compute the expected HMAC.

optional header?: string

Defined in: index.ts:9

Request header carrying the signature. Default: 'x-signature'.

Functions​

webhookMiddleware()​

webhookMiddleware(options): RequestHandler

Defined in: index.ts:33

Express webhook middleware: captures the raw request body, verifies its HMAC signature, then parses the JSON onto req.body for downstream handlers.

Mount it as the route's middleware, before any express.json(), which would otherwise consume the raw body needed to verify the signature:

app.post('/webhooks/github', webhookMiddleware({
  secret: env.WEBHOOK_SECRET,
  header: 'x-hub-signature-256',
  prefix: 'sha256=',
}), (req, res) => {
  // req.body is the parsed, verified payload
  res.sendStatus(204)
})

Responds 401 on a missing/invalid signature and 400 on an unparseable JSON body, using the standard @rtorcato/api-errors envelope.

Parameters​

options​

WebhookOptions

Returns​

RequestHandler