@upsec/webhook

Official Node.js SDK for verifying UpSec webhook signatures.

Installation

npm install @upsec/webhook

Quick Start

import { verifySignature } from "@upsec/webhook";

const isValid = verifySignature({
  payload: rawBody,
  secret: process.env.WEBHOOK_SECRET!,
  signature: req.headers["x-hub-signature-256"] as string,
});

Express Middleware

import express from "express";
import { webhookMiddleware } from "@upsec/webhook";

const app = express();

app.post(
  "/webhook",
  express.raw({ type: "application/json" }),
  webhookMiddleware({
    secret: process.env.WEBHOOK_SECRET!,
    header: "x-hub-signature-256", // default
  }),
  (req, res) => {
    // Signature is verified at this point
    res.json({ ok: true });
  }
);

API

verifySignature(options)

| Option | Type | Default | Description | |------------|----------|------------|--------------------------------------| | payload | string | — | Raw request body | | secret | string | — | Your webhook signing secret | | signature| string | — | Signature header value | | algorithm| string | "sha256" | HMAC algorithm |

webhookMiddleware(config)

Express middleware that auto-rejects requests with invalid signatures (401).

signPayload(payload, secret, algorithm?)

Compute a signed header value — useful for testing.

Supported Signature Formats

• sha256=<hex> (GitHub, Facebook)
• Raw hex string
• Custom algorithms via algorithm option