Methods to handle GitHub Webhook requests
Table of contents
Browsers |
🚧 Load <script type="module">
import {
sign,
verify,
verifyWithFallback,
} from "https://cdn.skypack.dev/@octokit/webhooks-methods";
</script> |
---|---|
Node |
Install with const {
sign,
verify,
verifyWithFallback,
} = require("@octokit/webhooks-methods"); |
await sign("mysecret", eventPayloadString);
// resolves with a string like "sha256=4864d2759938a15468b5df9ade20bf161da9b4f737ea61794142f3484236bda3"
await sign({ secret: "mysecret", algorithm: "sha1" }, eventPayloadString);
// resolves with a string like "sha1=d03207e4b030cf234e3447bac4d93add4c6643d8"
await verify("mysecret", eventPayloadString, "sha256=486d27...");
// resolves with true or false
await verifyWithFallback("mysecret", eventPayloadString, "sha256=486d27...", ["oldsecret", ...]);
// resolves with true or false
await sign(secret, eventPayloadString);
await sign({ secret, algorithm }, eventPayloadString);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
algorithm
(String)
|
Algorithm to calculate signature. Can be set to Learn more at Validating payloads from GitHub |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
Resolves with a signature
string. Throws an error if an argument is missing.
await verify(secret, eventPayloadString, signature);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
signature
(String)
|
Required.
Signature string as calculated by sign() .
|
Resolves with true
or false
. Throws error if an argument is missing.
await verifyWithFallback(
secret,
eventPayloadString,
signature,
additionalSecrets
);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
signature
(String)
|
Required.
Signature string as calculated by sign() .
|
additionalSecrets
(Array of String)
|
If given, each additional secret will be tried in turn. |
This is a thin wrapper around verify()
that is intended to ease callers' support for key rotation.
Resolves with true
or false
. Throws error if a required argument is missing.
See CONTRIBUTING.md