Quickstart

// npm install express standardwebhooks
const express = require("express");
const { Webhook } = require("standardwebhooks");

const wh = new Webhook(process.env.EVENTFORGE_WEBHOOK_SECRET); // whsec_...
const app = express();

// express.raw keeps the body as bytes, as sent: the signature covers them.
// The inbox takes up to 5 MB, so the endpoint does too.
app.post("/webhooks", express.raw({ type: "*/*", limit: "5mb" }), (req, res) => {
  try {
    // jsonParse: false checks the signature only; the body may be any text.
    wh.verify(req.body, req.headers, { jsonParse: false });
  } catch (err) {
    return res.status(400).send("invalid signature");
  }
  // webhook-id names the message: skip one you have already handled.
  console.log("verified", req.headers["webhook-id"], req.headers["content-type"], req.body.length, "bytes");
  res.sendStatus(204);
});

app.listen(3000);

# pip install flask standardwebhooks
import os

from flask import Flask, request
from standardwebhooks.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["EVENTFORGE_WEBHOOK_SECRET"])  # whsec_...
app = Flask(__name__)


@app.post("/webhooks")
def webhooks():
    # get_data() is the body as sent: the signature covers these bytes.
    payload = request.get_data()
    try:
        # json_parse=False checks the signature only; the body may be any text.
        wh.verify(payload, dict(request.headers), json_parse=False)
    except (WebhookVerificationError, ValueError):
        # ValueError: a malformed webhook-signature header.
        return "invalid signature", 400
    # webhook-id names the message: skip one you have already handled.
    print("verified", request.headers["webhook-id"], request.content_type, len(payload), "bytes")
    return "", 204

// go get github.com/standard-webhooks/standard-webhooks/libraries
package main

import (
	"errors"
	"io"
	"log"
	"net/http"
	"os"

	standardwebhooks "github.com/standard-webhooks/standard-webhooks/libraries/go"
)

func main() {
	wh, err := standardwebhooks.NewWebhook(os.Getenv("EVENTFORGE_WEBHOOK_SECRET")) // whsec_...
	if err != nil {
		log.Fatal(err)
	}
	http.HandleFunc("POST /webhooks", func(w http.ResponseWriter, r *http.Request) {
		// Read the body as sent: the signature covers these bytes. A body over
		// 5 MB, the inbox limit, is refused, not cut and half verified.
		payload, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 5<<20))
		if err != nil {
			status := http.StatusBadRequest
			var tooLarge *http.MaxBytesError
			if errors.As(err, &tooLarge) {
				status = http.StatusRequestEntityTooLarge
			}
			http.Error(w, "cannot read the body", status)
			return
		}
		if err := wh.Verify(payload, r.Header); err != nil {
			http.Error(w, "invalid signature", http.StatusBadRequest)
			return
		}
		// webhook-id names the message: skip one you have already handled.
		log.Printf("verified %s: %s, %d bytes", r.Header.Get("webhook-id"), r.Header.Get("Content-Type"), len(payload))
		w.WriteHeader(http.StatusNoContent)
	})
	log.Fatal(http.ListenAndServe(":3000", nil))
}

<?php
// composer require standard-webhooks/standard-webhooks
require __DIR__ . '/vendor/autoload.php';

$wh = new \StandardWebhooks\Webhook(getenv('EVENTFORGE_WEBHOOK_SECRET')); // whsec_...

// The body as sent: the signature covers these bytes.
$payload = file_get_contents('php://input');
// The library looks headers up in lower case; some servers capitalize them.
$headers = array_change_key_case(getallheaders(), CASE_LOWER);

try {
    $wh->verify($payload, $headers);
} catch (\Exception $e) {
    http_response_code(400);
    exit('invalid signature');
}
// webhook-id names the message: skip one you have already handled.
error_log('verified ' . $headers['webhook-id'] . ', ' . strlen($payload) . ' bytes');
http_response_code(204);