Verify webhook signatures

POST /webhooks/tinyrelay HTTP/1.1
Content-Type: application/json
svix-id: msg_2b7Qx...
svix-timestamp: 1730390400
svix-signature: v1,K5o3n1m... v1,9fZt0aQ...

{"eventType":"DELIVERED","receiver":"ann@example.com","requestId":"833c5151-...","metadata":{"order_id":"SO-1001"}, ...}

// server.mjs  (npm install express svix)
import express from "express";
import { Webhook } from "svix";

const app = express();
const wh = new Webhook(process.env.TINYRELAY_WEBHOOK_SECRET);

// Keep the raw body: do not run express.json() on this route
app.post("/webhooks/tinyrelay", express.raw({ type: "application/json" }), (req, res) => {
  try {
    wh.verify(req.body, {
      "svix-id": req.header("svix-id"),
      "svix-timestamp": req.header("svix-timestamp"),
      "svix-signature": req.header("svix-signature"),
    });
  } catch (err) {
    return res.status(400).send("Invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // event.eventType, event.receiver, event.metadata, ...
  res.sendStatus(204);
});

app.listen(3000);

# app.py  (pip install flask svix)
import json
import os

from flask import Flask, request
from svix.webhooks import Webhook, WebhookVerificationError

app = Flask(__name__)
wh = Webhook(os.environ["TINYRELAY_WEBHOOK_SECRET"])


@app.post("/webhooks/tinyrelay")
def tinyrelay_webhook():
    payload = request.get_data()  # raw bytes, not request.json
    try:
        wh.verify(payload, request.headers)
    except WebhookVerificationError:
        return "", 400

    event = json.loads(payload)
    # event["eventType"], event["receiver"], event["metadata"], ...
    return "", 204

<?php
// webhook.php  (composer require svix/svix)
require __DIR__ . '/vendor/autoload.php';

use Svix\Webhook;
use Svix\Exception\WebhookVerificationException;

$payload = file_get_contents('php://input');
$headers = [
    'svix-id'        => $_SERVER['HTTP_SVIX_ID'] ?? '',
    'svix-timestamp' => $_SERVER['HTTP_SVIX_TIMESTAMP'] ?? '',
    'svix-signature' => $_SERVER['HTTP_SVIX_SIGNATURE'] ?? '',
];

try {
    $wh = new Webhook(getenv('TINYRELAY_WEBHOOK_SECRET'));
    $wh->verify($payload, $headers);
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit;
}

$event = json_decode($payload, true);
// $event['eventType'], $event['receiver'], $event['metadata'], ...
http_response_code(204);

// verify.mjs  (no dependencies)
import crypto from "node:crypto";

export function verifyTinyRelay(rawBody, headers, secret, toleranceSeconds = 300) {
  const id = headers["svix-id"];
  const timestamp = headers["svix-timestamp"];
  const signatures = headers["svix-signature"];
  if (!id || !timestamp || !signatures) return false;

  // 1. Reject old or future-dated requests
  const ts = Number(timestamp);
  const now = Math.floor(Date.now() / 1000);
  if (!Number.isInteger(ts) || Math.abs(now - ts) > toleranceSeconds) return false;

  // 2. HMAC-SHA256 over "{svix-id}.{svix-timestamp}.{raw body}"
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();

  // 3. Any listed v1 signature may match (secret rotation sends two)
  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const given = Buffer.from(signature, "base64");
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

# verify.py  (standard library only)
import base64
import hashlib
import hmac
import time


def verify_tinyrelay(raw_body: bytes, headers, secret: str, tolerance: int = 300) -> bool:
    msg_id = headers.get("svix-id")
    timestamp = headers.get("svix-timestamp")
    signatures = headers.get("svix-signature")
    if not (msg_id and timestamp and signatures):
        return False

    # 1. Reject old or future-dated requests
    try:
        if abs(time.time() - int(timestamp)) > tolerance:
            return False
    except ValueError:
        return False

    # 2. HMAC-SHA256 over "{svix-id}.{svix-timestamp}.{raw body}"
    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()

    # 3. Any listed v1 signature may match (secret rotation sends two)
    for entry in signatures.split(" "):
        version, _, signature = entry.partition(",")
        if version == "v1" and hmac.compare_digest(signature, expected):
            return True
    return False

<?php
// verify.php  (no dependencies)
function verify_tinyrelay(string $rawBody, string $id, string $timestamp, string $signatures, string $secret, int $tolerance = 300): bool
{
    if ($id === '' || $signatures === '' || !ctype_digit($timestamp)) {
        return false;
    }

    // 1. Reject old or future-dated requests
    if (abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }

    // 2. HMAC-SHA256 over "{svix-id}.{svix-timestamp}.{raw body}"
    $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
    $expected = base64_encode(hash_hmac('sha256', "{$id}.{$timestamp}.{$rawBody}", $key, true));

    // 3. Any listed v1 signature may match (secret rotation sends two)
    foreach (explode(' ', $signatures) as $entry) {
        [$version, $signature] = array_pad(explode(',', $entry, 2), 2, '');
        if ($version === 'v1' && hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

$ok = verify_tinyrelay(
    file_get_contents('php://input'),
    $_SERVER['HTTP_SVIX_ID'] ?? '',
    $_SERVER['HTTP_SVIX_TIMESTAMP'] ?? '',
    $_SERVER['HTTP_SVIX_SIGNATURE'] ?? '',
    getenv('TINYRELAY_WEBHOOK_SECRET')
);
http_response_code($ok ? 204 : 400);