Hey @theroman,

To securely validate a webhook hash in Node.js, you can use the following approach:

1. Capture the raw request body to ensure you're hashing the exact data that was sent.
2. Extract the signature from the request headers and decode it from hex.
3. Generate a HMAC-SHA256 hash of the raw body using the webhook secret, and then convert it to a hex buffer.
4. Compare the hash to the signature using crypto.timingSafeEqual to ensure it's done securely.

Here's the code that should work fine:

// Get the raw body content.
const rawBody = await request.text();

// Your webhook secret set in Lemon Squeezy dashboard.
const secret = process.env.LEMONSQUEEZY_WEBHOOK_SECRET;

// Get the signature from the request headers.
const signature = Buffer.from(
  request.headers.get("X-Signature") ?? "",
  "hex",
);

// Create a HMAC-SHA256 hash of the raw `body` content using the `secret` and compare it to the `signature`.
const hmac = Buffer.from(
  crypto.createHmac("sha256", secret).update(rawBody).digest("hex"),
  "hex",
);

if (!crypto.timingSafeEqual(hmac, signature)) {
  // invalid signature
}

Make sure that both Lemon Squeezy API key and the Webhook are configured in the same mode (Test mode or live).

Hi @brankoconjic,

Unfortunately the suggested approach didn't work for me. Testing with express, nextjs and solid-start the resulting text body consistently had missing backslashes in all URL related data - resulting in a failed signature check.

In the end I opted for a hacky solution where I re-add the backslashes to match the payload:

const rawBody = (await event.request.text()).replace(/\//g, '\\/');

With this approach the signature check passes consistently.

It could be nice to be able to choose the integration type (node/php/python etc) from the webhook settings - and have a matching server signing the request on your end, without risking differing serialization/parsing methods influencing the output.

When working with webhooks, the raw body data must be read as bytes to avoid issues like the backslashes being altered during parsing.

There's a working Next.js webhook route example here.

Note that we are using Buffer and hex encoding to read bytes instead of parsing the body content.

@brankoconjic thanks for the updated example!

I cloned the example repo as is + my own webhook secret and keys.
verificatIon fails for me out of the box.
only after modifying https://github.com/lmsqueezy/nextjs-billing/blob/443939cd9e9093a61975177ddfaf07eecb650f18/src/app/api/webhook/route.ts#L17C1-L18C1 with .replace(/\//g, '\\/'); the signature verification passes

That's odd. Is that deployed somewhere or are you working locally?

Really not sure what's going on on your end without digging deeper into that. Here's a working, deployed version of the app (deployed on Vercel). Node v18 and v20 tested.

If you need further help with this, please reopen the issue.

Closed since cannot reproduce.