WebhooksVerify signature

Verify signature

HMAC-SHA256 of the raw body with the signing_secret.

Official Aivyro contentAligned with the current public contract

Header	Meaning
X-Aivyro-Signature	sha256= + hex HMAC-SHA256 of the raw body
X-Aivyro-Timestamp	ISO timestamp in the envelope
X-Aivyro-Nonce	Unique per delivery
X-Aivyro-Public-Event	Public name (contact.created)

Use event.public_type (or X-Aivyro-Public-Event) as the public name. event.type is internal. Rotate with POST /api/v1/webhooks/{id}/rotate_secret. The new secret is shown once. Old signatures fail.

verify.ts

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, signatureHeader, secret) {
  const got = signatureHeader.startsWith('sha256=')
    ? signatureHeader.slice(7)
    : signatureHeader;
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  return timingSafeEqual(Buffer.from(got, 'hex'), Buffer.from(expected, 'hex'));
}