@rtorcato/api-webhooks

Framework-agnostic webhook signature verification (HMAC) with timing-safe comparison. Use it directly, or drop in the Express or Hono adapter middleware.

import { verifySignature } from '@rtorcato/api-webhooks'

// GitHub-style: header `x-hub-signature-256: sha256=<hmac>`.
const ok = verifySignature(rawBody, req.header('x-hub-signature-256'), secret, {
  prefix: 'sha256=',
})

API

sign(payload, secret, options?)

Compute the hex HMAC signature for a raw payload. options: algorithm (default 'sha256'), prefix (default '').

verifySignature(payload, signature, secret, options?)

Timing-safe check that signature is a valid HMAC of payload. Returns false (never throws) on a missing or length-mismatched signature.

Always verify the raw request body, not a re-serialized object — JSON re-serialization changes bytes and breaks the signature. The Express adapter preserves the raw body for you.

Adapters

• @rtorcato/api-webhooks-express
• @rtorcato/api-webhooks-hono

License

MIT