Verify signatures | FluxDigest Developers

FluxDigest signs the timestamp and raw request body with HMAC-SHA256. The signature header uses this format:

FluxDigest-Signature: t=1787554800,v1=4af8...

Use the SDK helper and pass the raw body before JSON parsing:

Next.js App Router

import { headers } from "next/headers";
import { fluxdigest } from "@/lib/fluxdigest";

export async function POST(request: Request) {
  const body = await request.text();
  const signature = (await headers()).get("fluxdigest-signature");

  const event = fluxdigest.webhooks.constructEvent(
    body,
    signature,
    process.env.FLUXDIGEST_WEBHOOK_SECRET,
  );

  await queue.publish(event);
  return new Response(null, { status: 204 });
}

The helper validates the signature with constant-time comparison and rejects timestamps outside the default five-minute tolerance.

Do not parse first

Re-serializing parsed JSON changes whitespace and key ordering. Signature verification must receive the exact bytes sent by FluxDigest.

During secret rotation, accept both the active and previous secret for the overlap period shown in the developer dashboard.