Webhook signatures | Neuroline Docs

Neuroline signs every webhook in the x-webhook-signature header. The value is Base64-encoded HMAC-SHA256 over the exact raw request body. The HMAC key is the SHA-256 digest of the API key used to initiate the operation.

verify-webhook.ts

import { createHash, createHmac, timingSafeEqual } from "node:crypto";

export function verifyNeurolineWebhook(
  rawBody: Buffer,
  signature: string,
  apiKey: string,
): boolean {
  const signingKey = createHash("sha256").update(apiKey, "utf8").digest();
  const expected = createHmac("sha256", signingKey).update(rawBody).digest();
  const received = Buffer.from(signature, "base64");

  return (
    received.length === expected.length && timingSafeEqual(received, expected)
  );
}

Verify the signature before parsing or acting on the body, then follow the endpoint's callback documentation for acknowledgement and delivery behavior.