https://github.com/chec/webhook-verifier
A lightweight tool for verifying the validity of webhook payloads
https://github.com/chec/webhook-verifier
commercejs webhooks
Last synced: about 1 year ago
JSON representation
A lightweight tool for verifying the validity of webhook payloads
- Host: GitHub
- URL: https://github.com/chec/webhook-verifier
- Owner: chec
- License: bsd-3-clause
- Archived: true
- Created: 2021-10-25T19:32:40.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2021-12-16T01:21:55.000Z (over 4 years ago)
- Last Synced: 2025-03-12T10:11:21.289Z (over 1 year ago)
- Topics: commercejs, webhooks
- Language: TypeScript
- Homepage: https://commercejs.com
- Size: 137 KB
- Stars: 0
- Watchers: 4
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
Webhook verifier
A lightweight JavaScript tool for verifying the validity of incoming webhook payloads from the Chec API. This script
is designed to run in a Node.js context, e.g. a serverless function/Lambda.
commercejs.com | @commercejs | Slack
## Installation
```
npm install @chec/webhook-verifier
# or
yarn add @chec/webhook-verifier
```
## Usage
Import `verifyWebhook` and use it at the start of your handler method. Provide your Chec webhook signing key as the
second argument (available in your [Chec Dashboard](https://dashboard.chec.io/settings/webhooks)):
```js
import { verifyWebhook } from '@chec/webhook-verifier';
module.exports = function (request) {
verifyWebhook(request, process.env.CHEC_WEBHOOK_SIGNING_KEY);
// ... continue with your logic
}
```
The `verifyWebhook` method signature is:
```ts
interface Payload {
signature?: string,
created: number,
}
export function verifyWebhook(data: Payload, signingKey: string, maxAgeSeconds: number = 300): void {
// ...
}
```
The `verifyWebhook` method will throw an error if any checks fail:
* The webhook signature is missing, or the signing key is missing
* The webhook signature was invalid
* The request is older than 5 minutes (by default)
## License
This repository is available under a [BSD-3-Clause license](./LICENSE.md).