Sign and verify webhook deliveries

At a glanceCopy Anchor Link

• Who: Developers receiving webhooks who must prove the sender and freshness.
• What: Sign outgoing and verify incoming webhook payloads (HMAC + timestamp window).
• Use when: For every webhook endpoint exposed to a third party.
• Avoid when: For internal service-to-service calls — use mTLS or network policy instead.

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 0.1.2 (via changesets).

ExampleCopy Anchor Link

import { verifyWebhookSignatureHeader as verify } from "@zedtech/zedkit-server";
if (!verify(secret, rawBody, headers["webhook-signature"], { maxAgeSeconds: 300 })) {
  return unauthorized();
}

Wraps: (none)