Skip to main content
zerotal

Documentation

Documentation / zerotal / index / WebhookOptions

Interface: WebhookOptions

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:12

Properties

secret

secret: string

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:14

HMAC secret used to verify the signature.

optional header?: string

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:16

Request header that carries the signature. Default: 'x-webhook-signature'.

algorithm?

optional algorithm?: "sha1" | "sha256" | "sha512"

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:18

HMAC algorithm. Default: 'sha256'.

prefix?

optional prefix?: string

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:23

Expected signature prefix that will be stripped before comparison (e.g. 'sha256=' for GitHub). Default: ''.

tolerance?

optional tolerance?: number

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:28

Max age in seconds for replay-attack protection. Requires timestampHeader (or format: 'stripe'). Disabled when undefined.

timestampHeader?

optional timestampHeader?: string

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:33

Header that carries the Unix timestamp of the request. When present the signed payload becomes {timestamp}{timestampSeparator}{body}.

timestampSeparator?

optional timestampSeparator?: string

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:35

Separator between timestamp and body in the signed payload. Default: '.'.

format?

optional format?: "raw" | "stripe"

Defined in: packages/core/src/middleware/WebhookMiddleware.ts:41

Header format.

  • 'raw' (default) — signature is the full (or prefix-stripped) header value.
  • 'stripe' — header is parsed as t=<ts>,v1=<sig> (Stripe-Signature style).