Verify webhooks in browsers and edge runtimes

At a glanceCopy Anchor Link

• Who: Authors verifying signed webhook deliveries outside Node (Workers, Deno, browser tests).
• What: Async HMAC verification with global crypto.subtle, symmetric tolerance both ways of the clock (default 300 s).
• Use when: When the main server verifier cannot load (node:crypto) but the runtime provides Web Crypto.
• Avoid when: On Node servers — use verifyWebhookSignatureHeader on the main export instead.
• See also: Sign and verify webhook deliveries

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 1.3.0 (via changesets).

ExampleCopy Anchor Link

import { verifyWebhookSignatureWeb } from "@zedtech/zedkit-server/webhook-web";
const ok = await verifyWebhookSignatureWeb(secret, request.headers.get("webhook-signature") ?? undefined, rawBody);
if (!ok) return unauthorized();

Wraps: (none)