EVENTSHMAC SHA-512

Webhooks & Signatures

Verixa ID sends signed HTTP POST requests to your configured webhook endpoints when events happen in your account.

Verifying Signatures

Each webhook delivery contains a x-verixa-signature header containing an HMAC SHA-512 hash of the raw payload computed with your endpoint signing secret.

Node.js Webhook Handler

const express = require('express');
const crypto = require('crypto');
const app = express();
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-verixa-signature'];
  const secret = process.env.VERIXA_WEBHOOK_SECRET;
  const expectedSignature = crypto
    .createHmac('sha512', secret)
    .update(req.body)
    .digest('hex');
  if (signature !== expectedSignature) {
    return res.status(400).send('Invalid signature');
  }
  const event = JSON.parse(req.body.toString());
  console.log('Received valid event:', event.event);
  res.status(200).json({ received: true });
});