A warmr event delivered to your configured endpoint

Warmr POSTs a signed JSON body to your URL. Verify with X-Warmr-Signature: sha256=<hmac-sha256(rawBody, secret)>. Delivery is at-least-once; dedupe on X-Warmr-Event-Id. Retries: up to 5 attempts over 72h.

Compute the HMAC over the RAW request body (not a re-serialized object) using the signing secret returned once when you created the webhook, then compare in constant time:

import crypto from "node:crypto";
// The SDK ships this as verifyWebhookSignature(rawBody, header, secret).
function verify(rawBody, header, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header ?? ""), b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}