Webhook verification

Verify HMAC signatures on inbound webhook requests.

Algorithm

1. Read raw request body (before JSON parse)
2. Concatenate {timestamp}.{rawBody}
3. HMAC-SHA256 with your webhook secret
4. Compare hex digest to X-Eventyvo-Signature (constant-time)

Node.js (@eventyvo/embed)

import { verifyWebhookSignature } from "@eventyvo/embed";

const ok = verifyWebhookSignature({
  payload: rawBody,
  secret: process.env.WEBHOOK_SECRET,
  signature: req.headers["x-eventyvo-signature"],
  timestamp: req.headers["x-eventyvo-timestamp"],
});

Timestamp tolerance

Reject requests older than 5 minutes to prevent replay attacks.

Response

Return 2xx quickly — process asynchronously. Non-2xx triggers retries.