Find answers, product guides, and API docs without leaving the dashboard.

Webhook endpoints should accept only signed events over HTTPS, enforce idempotency on your side, and log delivery failures with enough context to replay safely.

01  import crypto from 'node:crypto'
02  
03  export function verifySignature(payload: string, secret: string, signature: string) {
04    const digest = crypto.createHmac('sha256', secret).update(payload).digest('hex')
05    return crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(signature))
06  }

• Use a dedicated endpoint and secret per environment.
• Log status code, duration, and event ID for every delivery.
• Keep a replay path for failed but valid signed events.