Webhook Security

Overview

Every outgoing webhook request from Asiyst contains a cryptographic signature header (x-asiyst-signature) allowing your server to verify that the payload genuinely originated from Asiyst.

Verifying HMAC SHA-256 Signatures

import crypto from "crypto";
export function verifyAsiystWebhook(payload: string, signatureHeader: string, secret: string): boolean {
  const [timestampPart, signaturePart] = signatureHeader.split(",");
  const timestamp = timestampPart.split("=")[1];
  const signature = signaturePart.split("=")[1];
  // Prevent replay attacks (reject if older than 5 minutes)
  if (Math.abs(Date.now() - parseInt(timestamp, 10)) > 300000) {
    return false;
  }
  const expectedSignature = crypto
    .createHmac("sha256", secret)
    .update(${timestamp}.${payload})
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
}