Signing outgoing webhooks and verifying incoming ones (Stripe/GitHub-style HMAC).
Overview
Both directions: sign & deliver outgoing webhooks with retries + backoff, and verify incoming ones (timing-safe, replay-protected) with ready-made Stripe / GitHub / Shopify presets — plus event ids & idempotency for exactly-once handlers. A zero-dep alternative to hosted svix.
Install
$ npm install @lacspace/webhooks
Quick example
@lacspace/webhooksts
await verify(rawBody, header, { secret })
Returns { valid: true }
Tips
Verify the signature AND the timestamp to prevent replay attacks; the verifier checks both.
Watch out for
Use a constant-time comparison (the package does) — never compare signatures with `===`.
Looking for the complete API and more examples? The npm page and GitHub README carry the full reference — or grab the PDF.
