Webhooks
Verify signatures
Every webhook carries a signature so you can prove it came from Postwick.
- Read the headers
Each request has
pw-id,pw-timestampandpw-signature. - Rebuild the signed string
Join the id, timestamp and raw body with full stops.
- Compare
HMAC-SHA256 that string with your endpoint secret and compare it to the signature in constant time.
import { Webhook } from 'postwick';
const wh = new Webhook(process.env.POSTWICK_WEBHOOK_SECRET);
const event = wh.verify(rawBody, headers); // throws if it does not matchWas this page helpful?