GuideBackend Integration
Webhook Delivery & HMAC Verification
Secure your backend receiver against spoofed event payloads by verifying HMAC-SHA256 signatures and handling deduplication for idempotent processing.
Signature Verification Code
import crypto from "crypto";
export function verifyNineAuthWebhook(
rawBody: string | Buffer,
signatureHeader: string,
secret: string
): boolean {
const hmac = crypto.createHmac("sha256", secret);
hmac.update(rawBody);
const calculated = hmac.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(signatureHeader, "utf8"),
Buffer.from(calculated, "utf8")
);
}