@samva/webhooks

Verify signed Samva webhook deliveries in Node.js, Bun, Cloudflare Workers, and other Web Crypto-compatible runtimes.

import { verifyRequest } from "@samva/webhooks";

const verified = await verifyRequest(request, process.env.SAMVA_WEBHOOK_SECRET!);
await persistAndHandleOnce(verified.id, verified.event);

Verification reads the exact request body, validates the Standard Webhooks signature and replay window, and returns { id, event }. verified.id matches the webhook-id header. Preserve the raw request body and keep the signing secret on the server.

Effect applications can use the optional Effect entrypoint:

import * as Webhooks from "@samva/webhooks/effect";

const verified = yield * Webhooks.verifyRequest(request, secret);

Install the exact optional peer [email protected] when using that entrypoint.