WebhookGuard for Node.js

A secure, modern webhook signature library for Node.js. WebhookGuard uses asymmetric cryptography (RSA-SHA256 with PSS padding) and replay attack prevention to ensure your webhook endpoints are robust and secure.

The core principle is to sign webhooks with a private key and verify them with a public key, eliminating the need to share secrets.

Features

• Asymmetric Signatures: Secure RSA key pair authentication.
• Modern Cryptography: Implements the recommended RSA-PSS padding scheme.
• Replay Attack Prevention: Built-in support for timestamp and nonce checking.
• Developer-Friendly: Throws detailed, specific errors for easy debugging.

Getting Started

1. Installation

   npm install webhookguard

2. Key Generation

   # Generate a 2048-bit private key
   openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
   
   # Extract the public key from the private key
   openssl rsa -pubout -in private_key.pem -out public_key.pem

Documentation

For detailed usage examples, API reference, and security best practices, please see our full documentation.

➡️ View the Full Documentation

Contributing

Contributions are welcome! Please feel free to open an issue or submit a pull request.

Author

• Jawad Shafique

License

This project is licensed under the MIT License - see the LICENSE file for details.