remote preview · signatures
Verify the raw body first.
Validate timestamped HMAC-SHA256 webhook signatures with Web Crypto before parsing or dispatching an event.
Signature verification is a shipped SDK utility. The webhook producer belongs to the preview service horizon, so integrations can be built and tested without claiming a live endpoint.
Read the request body as text.
The signature covers timestamp dot raw body. JSON parsing and reserialization can change bytes, so verification must happen first.
const rawBody = await request.text()
const signature = request.headers.get('X-Nika-Signature') ?? ''
const valid = await Nika.verifyWebhook(
rawBody,
signature,
process.env.NIKA_WEBHOOK_SECRET!,
)Refuse stale and mismatched signatures.
The verifier checks timestamp tolerance, expected length and a constant-time character comparison. Return before parsing when it is false.
if (!valid) {
return new Response('invalid signature', { status: 401 })
}
const event = JSON.parse(rawBody)Test the verifier independently.
Use fixture payloads in application tests today. Enable network delivery only when the compatible service and its webhook contract are published.