@typedhook/verify

Zero-dependency webhook signature verification. WebCrypto only — Node 20+, Bun, Deno, Cloudflare Workers, edge. Verifies Standard Webhooks signatures (svix-* headers accepted too), so it works with svix-style senders as well as @typedhook/sdk.

import { createVerifier } from "@typedhook/verify";

const verifier = createVerifier(process.env.WEBHOOK_SECRET!);

// fetch-style frameworks (Next.js, Hono, Remix, Workers)
export async function POST(req: Request) {
  const result = await verifier.verify(req);
  if (!result.ok) return new Response(result.reason, { status: 400 });
  result.payload; // parsed JSON body
  return new Response(null, { status: 204 });
}

// express / fastify — pass the RAW body
const result = await verifier.verifyPayload(req.body, req.headers);

Failures are reason codes, never exceptions. Signatures are checked over the raw bytes received. Delivery is at-least-once — dedupe on result.id (stable across retries).

Typed events from the registry

Senders that publish their events with the publish action can be typed without installing anything from them. The typedhook CLI pulls their events as types for verifier.verify<Events>():

npm install typedhook
npx typedhook add acme/billing

See the CLI README.

Full docs: https://github.com/ThallesP/typedhook