Webhook Server

A Next.js webhook server with standard-webhooks signature verification.

Endpoints

POST /api/webhook

Receive webhook events with standard-webhooks signature verification.

Required Headers

Header	Description
`webhook-id`	Unique message identifier (e.g., `msg_abc123`)
`webhook-timestamp`	Unix timestamp in seconds (e.g., `1732000000`)
`webhook-signature`	Signature: `v1,<base64-hmac-sha256>`

Signature Calculation

1. Construct the signed content:

signed_content = webhook_id + "." + webhook_timestamp + "." + body

2. Compute HMAC-SHA256 with the secret (base64-decode the secret first):

signature = base64(HMAC-SHA256(base64_decode(secret), signed_content))

3. Prefix with version: v1,<signature>

Request Body

JSON payload (any structure):

{
  "type": "user.created",
  "data": {
    "id": "user_123",
    "email": "user@example.com"
  }
}

Response

200Signature verified successfully

401Invalid signature

GET /api/events

List all received webhook events (both verified and failed).

Response

[
  {
    "headers": {
      "id": "msg_abc123",
      "timestamp": "1732000000",
      "signature": "v1,..."
    },
    "payload": { ... },
    "rawBody": "...",
    "verified": true,
    "receivedAt": "2024-11-19T..."
  }
]

DELETE /api/events

Clear all stored events.