Verifikasi Webhook

Setiap outgoing webhook di-tanda-tangani dengan HMAC-SHA256 atas body JSON mentah, hex-encoded, pada header X-Omnistream-Signature. Selalu verifikasi signature sebelum mem-parse body.

Dengan SDK

Code
import { verifyWebhookSignature } from "@omnistreams/sdk";

// rawBody harus body mentah persis seperti diterima — verifikasi SEBELUM JSON.parse.
const ok = await verifyWebhookSignature(
  rawBody,
  req.headers["x-omnistream-signature"],
  webhookSecret,
);
if (!ok) return res.status(401).end();

Rotasi secret

Selama rotasi secret, gateway ikut mengirim X-Omnistream-Signature-Previous (ditandatangani secret lama). Terima salah satu:

Code
import { verifyWebhookSignatureWithRotation } from "@omnistreams/sdk";

const ok = await verifyWebhookSignatureWithRotation(rawBody, webhookSecret, {
  current: req.headers["x-omnistream-signature"],
  previous: req.headers["x-omnistream-signature-previous"],
});

Tanpa SDK (Node.js)

Code
import crypto from "node:crypto";

function verify(rawBody, signatureHex, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(signatureHex, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}