Provider standard

GitHub webhook signature verification

GitHub signs every delivery. Your receiver must verify x-hub-signature-256 against the raw request body before processing anything. Official documentation.

Test your GitHub receiver now

The free verification suite dispatches all eight vectors — valid signature, tampered body, corrupted signature, expired and future timestamps, missing header, rapid replay, and malformed JSON — against your endpoint in seconds.

Run the verification suite

Reference implementations

Correct verification code for GitHub webhooks, per framework.

Next.js App Router (app/api/webhooks/github/route.ts)

import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";

export async function POST(req: NextRequest) {
  const signature = req.headers.get("x-hub-signature-256");
  if (!signature) {
    return NextResponse.json({ error: "Missing x-hub-signature-256" }, { status: 400 });
  }

  const rawBody = await req.text();
  const hmac = crypto.createHmac("sha256", process.env.GITHUB_WEBHOOK_SECRET!);
  const digest = "sha256=" + hmac.update(rawBody).digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(digest))) {
    return NextResponse.json({ error: "Signature mismatch" }, { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  // Process GitHub webhook payload...

  return NextResponse.json({ ok: true });
}