Send real-time events to your own endpoints. Every request is signed so you can verify it came from us.
Active endpoints
4 / 5
Deliveries
38
Success rate
79%
Failed deliveries
8
Success
71%
Last event
9m ago
Success
75%
Last event
2m ago
Success
75%
Last event
6m ago
Success
100%
Last event
1m ago
Success
83%
Last event
6m ago
Compute an HMAC-SHA256 of timestamp.body with the endpoint's signing secret and compare it with the header in constant time.
import crypto from "node:crypto";
// Every request carries a "Webhook-Signature: t=<unix>,v1=<hex>" header.
export function verifyWebhook(rawBody, header, secret) {
const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300; // reject replays older than 5 minutes
return fresh && crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}