bothy-sdk
    Preparing search index...

    Function verifyWebhook

    • Verifies one delivery of an outgoing webhook or a request to interactions_url.

      Steps, each with its error code (docs/decisions.d/M2-30.md D-M2-30-9): the three headers present (missing_header); webhook-timestamp an integer of Unix seconds (invalid_timestamp); its distance to now() at most toleranceMs in both directions (timestamp_out_of_tolerance); at least one key or secret configured (no_trusted_key); one entry of webhook-signature valid over {webhook-id}.{webhook-timestamp}.{body} (signature_mismatch). Entries are split at spaces and at their first comma; an unknown scheme or bad base64 is ignored. v1a entries are checked against every key with Ed25519, v1 entries against every secret with HMAC-SHA256 compared in constant time.

      Duplicate detection is the app's duty: remember VerifiedWebhook.id for at least webhook.retry_max_age (docs/api/webhooks.md 3 point 4).

      Parameters

      Returns VerifiedWebhook

      The verified delivery with its decoded event.

      WebhookVerificationError when the delivery fails a step; its message never contains the body, a signature or a secret.

      WebhookConfigError when a configured key or secret is malformed.

      const keys = await keyCache.keys();
      const verified = verifyWebhook({ body: rawBody, headers: req.headers, keys });
      if (verified.event.kind === "known") handle(verified.event.event);

    Settings

    Member Visibility