Authentication - Beach Depository

Verify every delivery before you use it. The signing secret from Create Webhook is shown once. Store it, then rotate it in Settings > Webhooks if you need a new one.

Headers

Header	Description
`Content-Type`	`application/json`
`svix-id`	Unique message ID
`svix-timestamp`	Unix timestamp when the message was signed
`svix-signature`	Space-separated signatures (`v1,...`)

Verify with the raw request body. A parsed JSON body will not match the signature.

Node.js

import { Webhook } from "svix"

const secret = process.env.WEBHOOK_SECRET

app.post("/webhooks/purevault", (req, res) => {
  const payload = req.rawBody
  const headers = {
    "svix-id": req.headers["svix-id"],
    "svix-timestamp": req.headers["svix-timestamp"],
    "svix-signature": req.headers["svix-signature"],
  }

  const wh = new Webhook(secret)
  let msg
  try {
    msg = wh.verify(payload, headers)
  } catch {
    return res.status(400).send("Invalid signature")
  }

  const { event, data } = msg
  console.log(event, data)
  res.status(200).send("OK")
})

Python

from svix.webhooks import Webhook, WebhookVerificationError

secret = os.environ["WEBHOOK_SECRET"]

def handle_webhook(payload: bytes, headers: dict):
    wh = Webhook(secret)
    try:
        msg = wh.verify(payload, headers)
    except WebhookVerificationError:
        return False
    return True

Other languages are in the Svix verifying payloads guide.

Endpoint URL

url must be https:// and a public hostname. Bare IPs, private or loopback addresses, embedded credentials, and names such as .local or .internal are rejected.