Verify webhook signatures with one call
By Steven Van ·
The new verifyWebhookSignature() helper confirms that a webhook event really came from Notion, so you no longer need to hand-write the HMAC check.
Notion has added a verifyWebhookSignature() helper... Let me redo without code tags since only p, ul, li, h2, strong, em, a are allowed.
Notion's webhooks SDK now includes a verifyWebhookSignature() helper, so developers no longer need to hand-write the HMAC check for incoming events. It takes the raw request body, the X-Notion-Signature header, and the subscription's verification token, compares signatures in constant time, and returns false instead of throwing when the input is malformed.
It works without configuration in Node.js 18+, Bun, Deno, Cloudflare Workers, Vercel Edge Functions, and browsers. A companion signWebhookPayload() function generates signatures for testing a handler, detailed in the changelog entry.
