Verifying webhooks

​

Headers Sent with Webhooks

​

How to Construct the Signed Content

const signedContent = `${svix_id}.${svix_timestamp}.${body}`;

• svix_id: from the svix-id header
• svix_timestamp: from the svix-timestamp header
• body: the raw body of the request

⚠️ Do not modify the request body before verification. Even small changes will invalidate the signature.

​

How to Compute the Expected Signature

1. Take your signing secret (remove the whsec_ prefix).
2. Decode the base64 portion.
3. HMAC the signedContent using the decoded secret.

​

Node.js Example

const crypto = require('crypto');

const signedContent = `${svix_id}.${svix_timestamp}.${body}`;
const secret = "whsec_5WbX5kEWLlfzsGNjH64I8lOOqUB6e8FH";

// Decode the secret (strip "whsec_" prefix)
const secretBytes = Buffer.from(secret.split('_')[1], "base64");

const signature = crypto
  .createHmac('sha256', secretBytes)
  .update(signedContent)
  .digest('base64');

console.log(signature);

​

Matching the Signature

v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OE= v2,abcdef==

• Remove the version prefix (v1,, v2, etc.).
• Compare the base64-encoded result with your computed signature.
• Use constant-time comparison to avoid timing attacks.

​

Verifying the Timestamp

• Reject the webhook if the timestamp is outside an acceptable window (e.g., ±5 minutes).
• This prevents replay/timestamp attacks.

​

Example Signature

secret     = 'whsec_plJ3nmyCDGBKInavdOK15jsl'
payload    = '{"event_type":"ping","data":{"success":true}}'
msg_id     = 'msg_loFOjxBNrRLzqYUf'
timestamp  = '1731705121'

// Expected signature
signature  = 'v1,rAvfW3dJ/X/qxhsaXPOyyCGmRKsaKWcsNccKXlIktD0='

If the timestamp is outdated, verification will fail — this is expected.