Verifying signatures
Verify that incoming webhook requests originated from Plunk.
Every webhook request includes a Plunk-Signature header, an HMAC-SHA256 signature of the raw request body using your webhook signing secret.
typescript
import { createHmac, timingSafeEqual } from "crypto";
function isValid(rawBody: string, signature: string, secret: string) {
const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}