validateWebhookSignature

Verify that an inbound request was genuinely signed by SignalWire. This is the primary entry point for webhook signature validation. Compute it over the raw request body before any JSON or form parsing.

1 validateWebhookSignature(signingKey: string, signature: string, url: string, rawBody: string): boolean

rawBody must be the raw request body as a UTF-8 string. Passing a parsed object throws a TypeError. For pre-parsed form params, use validateRequest() instead.

Parameters

signingKey

stringRequired

Your SignalWire Signing Key. An empty or non-string value throws an Error.

signature

stringRequired

The signature header value (X-SignalWire-Signature or X-Twilio-Signature). A missing or empty value returns false.

url

stringRequired

The full URL SignalWire POSTed to.

rawBody

stringRequired

The raw request body as a UTF-8 string, before JSON or form parsing.

Returns

boolean — true when the signature matches; false otherwise. The comparison is constant-time.

Example

1 import { validateWebhookSignature } from '@signalwire/sdk';
2 import { Hono } from 'hono';
3 
4 const app = new Hono();
5 
6 app.post('/webhook', async (c) => {
7   const rawBody = await c.req.text();
8   const signature = c.req.header('x-signalwire-signature') ?? '';
9   const url = c.req.url;
10 
11   const ok = validateWebhookSignature(
12     process.env.SIGNALWIRE_SIGNING_KEY!,
13     signature,
14     url,
15     rawBody,
16   );
17   if (!ok) return c.text('Forbidden', 403);
18 
19   return c.json({ received: JSON.parse(rawBody) });
20 });