Core

Webhook Signature Validation

View as MarkdownOpen in Claude

SignalWire signs the webhook requests it sends to your endpoints. These utilities verify those signatures so you can reject forged or tampered requests. All are imported directly from @signalwire/sdk.

1import {
2  validateWebhookSignature,
3  validateRequest,
4  webhookValidationMiddleware,
5  SIGNALWIRE_SIGNATURE_HEADER,
6  TWILIO_COMPAT_SIGNATURE_HEADER,
7} from '@signalwire/sdk';

If you are building with AgentBase, set the signingKey constructor option instead — the agent auto-mounts webhookValidationMiddleware on its endpoints for you.

Functions

validateWebhookSignature

Verify a signature against a raw request body.

validateRequest

Legacy compatibility-api drop-in accepting parsed form params.

webhookValidationMiddleware

Hono middleware that validates and rejects unsigned requests.

Signature header constants

SIGNALWIRE_SIGNATURE_HEADER
string

The SignalWire signature header name: 'x-signalwire-signature'.

TWILIO_COMPAT_SIGNATURE_HEADER
string

The Twilio-compatible signature header name: 'x-twilio-signature', recognized on the compatibility surface.