webhookValidationMiddleware

Create a Hono middleware that captures the raw request body, validates the SignalWire signature via validateWebhookSignature(), and rejects requests that fail. On failure it responds 403 Forbidden with no body detail (to avoid leaking which check failed); on success it calls next().

1 webhookValidationMiddleware(opts: WebhookValidationOptions): MiddlewareHandler

AgentBase auto-mounts this middleware on POST /, /swaig, and /post_prompt when you set its signingKey constructor option. Use this factory directly only when wiring validation into your own Hono app.

Parameters

opts

WebhookValidationOptionsRequired

Middleware options.

opts.signingKey

stringRequired

Your SignalWire Signing Key. An empty string throws at construction time.

opts.trustProxy

booleanDefaults to false

When true, honor X-Forwarded-Proto and X-Forwarded-Host when reconstructing the public URL. Defaults to false because those headers are spoofable. SWML_PROXY_URL_BASE always takes precedence.

Returns

MiddlewareHandler — A Hono middleware that validates the signature, responds 403 on failure, and calls next() on success.

Example

1 import { webhookValidationMiddleware } from '@signalwire/sdk';
2 import { Hono } from 'hono';
3 
4 const app = new Hono();
5 
6 app.use(
7   '/webhook',
8   webhookValidationMiddleware({ signingKey: process.env.SIGNALWIRE_SIGNING_KEY! }),
9 );
10 
11 app.post('/webhook', async (c) => {
12   // Only signed requests reach here
13   return c.json({ ok: true });
14 });