Webhook signatures

Verify the Fernway-Signature header with your endpoint secret before trusting any webhook payload.

Applies to

verify-signature.js

1// Placeholder: Fernway is a fictional API.
2import crypto from "node:crypto"
3 
4export function verify(rawBody, header, secret) {
5  const [t, v1] = header.split(",").map((p) => p.split("=")[1])
6  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false
7  const expected = crypto
8    .createHmac("sha256", secret)
9    .update(`${t}.${rawBody}`)
10    .digest("hex")
11  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))
12}

How signing works

Each webhook carries a Fernway-Signature header in the form t=timestamp,v1=signature. The signature is an HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your endpoint secret.

Verify every request

Use the raw body exactly as received. Parsing and re-serialising JSON changes the bytes.
Reject timestamps older than five minutes to stop replays.
Compare with a constant-time function such as timingSafeEqual.

Rotating secrets

Roll a secret from the dashboard. For 24 hours both secrets sign each event, so you can deploy the new one without dropping events.

Placeholder API

Fernway is a fictional product used to show how this template works. Replace these docs with your own in the CMS.

← Webhooks

Migrating v1 to v2 →