Class WebhooksModule

Utilities for verifying and parsing incoming Hadawi webhook events.

Hadawi signs every outgoing webhook POST with HMAC-SHA256 over the raw JSON body using your webhookSecret. The hex digest is sent in the X-Hadawi-Signature request header.

Example

// Express handler
app.post('/webhooks/hadawi', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-hadawi-signature'] as string;
  const event = hadawi.webhooks.constructEvent(req.body, sig);

  if (event.type === 'order.funded') {
    await hadawi.orders.fulfill(event.payload.order_id!);
  }

  res.sendStatus(200);
});

Constructors

constructor

Methods

verifySignature constructEvent

Constructors

constructor

Methods

verifySignature

  • verifySignature(
        rawBody: string | Buffer<ArrayBufferLike>,
        signature: string,
    ): boolean

    Verify the X-Hadawi-Signature header against the raw request body. Returns true if the signature is valid.

    Prefer constructEvent() which combines verification + parsing.

    Parameters

    • rawBody: string | Buffer<ArrayBufferLike>
    • signature: string

    Returns boolean

constructEvent

  • constructEvent(
        rawBody: string | Buffer<ArrayBufferLike>,
        signature: string,
    ): HadawiWebhookEvent

    Verify the signature and parse the raw body into a typed HadawiWebhookEvent. Throws HadawiWebhookError if the signature is invalid.

    Important: use express.raw() (or equivalent) to get the raw body — do NOT parse the body as JSON before passing it to this method.

    Parameters

    • rawBody: string | Buffer<ArrayBufferLike>
    • signature: string

    Returns HadawiWebhookEvent

Settings

Member Visibility

On This Page

Constructors
Methods