Verifying Signatures

import express from 'express';
import { Webhook } from 'svix';

const app = express();
const wh = new Webhook(process.env.KAITEN_WEBHOOK_SECRET);

// Register the route with a raw-body parser: the signature covers the bytes as sent.
app.post('/kaiten-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = wh.verify(req.body, req.headers); // throws if the signature does not verify
  } catch (err) {
    return res.status(400).send('invalid signature');
  }
  // event.name, event.type, event.data — the published contract; event.headers when present
  res.status(200).send('ok');
});

import json
import os

from fastapi import FastAPI, Request, Response
from svix.webhooks import Webhook, WebhookVerificationError

app = FastAPI()
wh = Webhook(os.environ["KAITEN_WEBHOOK_SECRET"])

@app.post("/kaiten-webhook")
async def handle_webhook(request: Request):
    body = await request.body()  # raw bytes, before any JSON parsing
    try:
        wh.verify(body, request.headers)  # raises if the signature does not verify
    except WebhookVerificationError:
        return Response(status_code=400)
    event = json.loads(body)  # event["name"], event["type"], event["data"]; event.get("headers") when present
    return {"status": "ok"}

package main

import (
    "io"
    "log"
    "net/http"
    "os"

    svix "github.com/svix/svix-webhooks/go"
)

func main() {
    // An unset or malformed secret is refused here, at startup, not on the first delivery.
    wh, err := svix.NewWebhook(os.Getenv("KAITEN_WEBHOOK_SECRET"))
    if err != nil {
        log.Fatal(err)
    }

    http.HandleFunc("/kaiten-webhook", func(w http.ResponseWriter, r *http.Request) {
        body, err := io.ReadAll(r.Body) // raw bytes, before any JSON decoding
        if err != nil {
            http.Error(w, "cannot read body", http.StatusBadRequest)
            return
        }
        if err := wh.Verify(body, r.Header); err != nil {
            http.Error(w, "invalid signature", http.StatusBadRequest)
            return
        }
        // json.Unmarshal(body, &event) — name, type, data, and the optional headers
        w.WriteHeader(http.StatusOK)
    })
    log.Fatal(http.ListenAndServe(":8080", nil))
}