Ask, be told, or take the lot.

Check it came from us

Standard HMAC, no library required. Reject stale timestamps and compare in constant time, and a captured request cannot be replayed at you.

// Every webhook carries: Saqr-Signature: t=<unix seconds>,v1=<hex>
// v1 is HMAC-SHA256 of "<t>.<raw body>" with your endpoint secret.
async function verify(raw: string, header: string, secret: string) {
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((p) => p.split("=") as [string, string])
  );
  // Reject anything older than five minutes: a captured request replayed later.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;

  const key = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"]
  );
  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${raw}`));
  const hex = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
  // Compare every character, so the time taken says nothing about where they differ.
  let diff = hex.length ^ v1.length;
  for (let i = 0; i < hex.length; i++) diff |= hex.charCodeAt(i) ^ (v1.charCodeAt(i) || 0);
  return diff === 0;
}

// Deliveries are at-least-once: store evt ids and ignore a second arrival.