Webhooks: Signed Event Delivery to Your Server

import { verifyWebhookSignature } from "@agent-loadout/sdk";

export async function handle(request: Request): Promise<Response> {
  const body = await request.text(); // the raw body, exactly as received
  const valid = await verifyWebhookSignature(process.env.LOADOUT_WEBHOOK_SECRET!, {
    signature: request.headers.get("x-loadout-signature"),
    previousSignature: request.headers.get("x-loadout-signature-previous"),
    timestamp: request.headers.get("x-loadout-timestamp"),
  }, body);
  if (!valid) return new Response("invalid signature", { status: 401 });
  const event = JSON.parse(body);
  // Deduplicate by event.id, then hand the work to a queue and answer quickly.
  return new Response(null, { status: 204 });
}

import os
from agentloadout import verify_webhook_signature

def handle(headers, raw_body: bytes):
    if not verify_webhook_signature(os.environ["LOADOUT_WEBHOOK_SECRET"], headers, raw_body):
        return 401
    # Deduplicate by the event id, then hand the work to a queue and answer quickly.
    return 204