Verify a webhook signature

Every delivery is signed with HMAC-SHA256 and carries a Fluveo-Signature header (plus a compatibility Stripe-Signature). Verify it against your endpoint’s whsec_… secret before parsing the body, and always verify the raw body — before any JSON parsing re-serializes a byte. This recipe uses the SDK helpers; for the full contract, replay rules, and retry behaviour see Webhooks.

1
import { webhooks } from "@fluveo/node";
2
3
app.post("/webhooks", express.raw({ type: "application/json" }), (req, res) => {
4
  const { ok, event } = webhooks.constructEvent({
5
    payload:   req.body, // raw Buffer
6
    signature: req.headers["fluveo-signature"] as string,
7
    secret:    process.env.FLUVEO_WEBHOOK_SECRET!,
8
  });
9
  if (!ok) return res.status(400).end();
10
  // handle event.type / event.data.object
11
  res.status(200).end();
12
});

Already using a Stripe verifier? Point stripe.webhooks.constructEvent(...) at the Stripe-Signature header and your whsec_… secret — it works unchanged. Keep handlers idempotent (key on the event id); deliveries can repeat.