Webhook validator

Gather what you need

Validate

What it checks

1. Takes your secret, removes any whsec_ prefix, and base64-decodes it.
2. Computes an HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{raw body}.
3. Base64-encodes the result and compares it with each v1, signature in the header.

Verify in your code

import { Webhook } from "standardwebhooks";

const webhook = new Webhook(process.env.SPOTFLOW_WEBHOOK_KEY);

// rawBody must be the exact text you received, not re-serialised JSON
const payload = webhook.verify(rawBody, {
  "webhook-id": req.headers["webhook-id"],
  "webhook-timestamp": req.headers["webhook-timestamp"],
  // Spotflow sends the signature as x-spotflow-signature
  "webhook-signature": req.headers["x-spotflow-signature"],
});

If the signature doesn’t match

• The body changed. Parsing and re-serialising JSON changes whitespace and key order. Verify the raw bytes you received.
• Wrong secret. Test and live mode have different webhook secrets.
• Extra whitespace. Copy header values exactly, with no trailing spaces or line breaks.
• Wrong separator. The three parts are joined with a single . and nothing else.
• Wrong encoding. The signature is base64, after the v1, prefix.