Skip to main content

@rtorcato/api-webhooks v0.1.0

Interfaces​

SignatureOptions​

Defined in: index.ts:3

Properties​

algorithm?​

optional algorithm?: string

Defined in: index.ts:5

HMAC hash algorithm. Default: 'sha256'.

prefix?​

optional prefix?: string

Defined in: index.ts:10

Prefix carried on the signature header value (included in both the computed and the compared value), e.g. GitHub's 'sha256='. Default: ''.

Functions​

sign()​

sign(payload, secret, options?): string

Defined in: index.ts:19

Compute the hex HMAC signature for a raw webhook payload.

Example​

const sig = sign(rawBody, secret, { prefix: 'sha256=' })

Parameters​

payload​

string | Buffer<ArrayBufferLike>

secret​

string

options?​

SignatureOptions = {}

Returns​

string

verifySignature()​

verifySignature(payload, signature, secret, options?): boolean

Defined in: index.ts:40

Timing-safe check that signature is a valid HMAC of payload for secret.

Framework-agnostic — verify the raw request body (not a re-serialized object) against the provider's signature header. Wrap it for Express/Hono in a dedicated adapter package.

Example​

if (!verifySignature(rawBody, req.header('x-hub-signature-256'), secret, { prefix: 'sha256=' })) {
  throw new UnauthorizedError('Invalid webhook signature')
}

Parameters​

payload​

string | Buffer<ArrayBufferLike>

signature​

string | null | undefined

secret​

string

options?​

SignatureOptions = {}

Returns​

boolean