Standard Webhooks

StandardWebhooks (standardwebhooks.com) signing + verification — the consortium spec (Stripe / Svix / Okta / etc.) for inbound webhook authentication. Three headers:

webhook-id ULID-ish unique identifier webhook-timestamp Unix seconds at send time webhook-signature v1, (multi-version)

The signature payload is .., signed with the shared secret. Verification reproduces the signature and uses b.crypto.timingSafeEqual to compare. Skew tolerated within tolerance seconds (default 5 minutes).

b.standardWebhooks.sign(opts) #

{
  id:        string,         // auto-minted if omitted (32-byte random)
  timestamp: number,         // Unix seconds; defaults to now
  body:      Buffer|string,  // request body bytes
  secret:    Buffer,         // shared secret (>= 32 bytes)
}

Build the three StandardWebhooks headers for an outbound delivery. Returns { headers, body } where body is the raw request body (operators write that to the wire; the headers go on the request).

var s = b.standardWebhooks.sign({ body: bodyBuf, secret: secret });
for (var k in s.headers) req.setHeader(k, s.headers[k]);

b.standardWebhooks.verify(opts) #

{
  headers:    object,           // request headers
  body:       Buffer|string,    // raw request body
  secret:     Buffer,           // shared secret
  toleranceSec: number,         // default 300s (5 minutes)
}

Verify an inbound webhook against the StandardWebhooks spec. Refuses on missing headers, timestamp skew > tolerance, or HMAC mismatch. Returns { valid, id, timestamp }.

var v = b.standardWebhooks.verify({
  headers: req.headers, body: rawBody, secret: secret,
});
if (!v.valid) throw 401;

Last updated 2026-08-08T16:39:49.652Z by seeder.