# Webhooks SDK

> One way to verify, parse, and route webhooks from every provider. Zero dependencies, Web Crypto only — runs on Node 22+, Cloudflare Workers, Deno, and Bun.

## Docs

- [Introduction](https://webhooks-sdk.com/docs): One way to verify, parse, and route webhooks from every provider.
- [Quickstart](https://webhooks-sdk.com/docs/quickstart): Install the SDK and handle your first webhook.

### Core concepts

- [Why the raw body matters](https://webhooks-sdk.com/docs/concepts/raw-body): Every signature scheme signs the exact bytes on the wire — parse first and verification breaks.
- [The event envelope](https://webhooks-sdk.com/docs/concepts/event-envelope): A normalized wrapper around every webhook — with the provider's payload left untouched.
- [Handshakes](https://webhooks-sdk.com/docs/concepts/handshakes): Most providers won't deliver anything until you answer a one-time challenge — and the right order differs.
- [Idempotency](https://webhooks-sdk.com/docs/concepts/idempotency): Duplicate deliveries are routine, not an edge case. Suppress them with a store.
- [Errors & outcomes](https://webhooks-sdk.com/docs/concepts/errors): Failures are returned, not thrown — every result carries an outcome, and every error a code and status.

### Guides

- [One route, many providers](https://webhooks-sdk.com/docs/guides/routing): Serve Stripe, GitHub, and everything else from a single endpoint with WebhookRouter.
- [Standalone verification](https://webhooks-sdk.com/docs/guides/standalone-verification): The router is optional — verify and parse without a handler.
- [Secret rotation](https://webhooks-sdk.com/docs/guides/secret-rotation): Pass an array of secrets; any match wins. Rotate with zero missed deliveries.
- [Framework adapters](https://webhooks-sdk.com/docs/guides/frameworks): Mount the same handler on Next.js, Hono, Express, bare Node — or anything that speaks Request.
- [Testing](https://webhooks-sdk.com/docs/guides/testing): Sign fixtures with the real algorithm instead of stubbing the verifier — a test that mocks verification tests nothing.

### Providers

- [Providers](https://webhooks-sdk.com/docs/providers): What ships today, what works via Standard Webhooks, and the nine scheme families behind it all.
- [Stripe](https://webhooks-sdk.com/docs/providers/stripe): HMAC over timestamp + body via Stripe-Signature — replay-safe, with first-class secret rotation.
- [GitHub](https://webhooks-sdk.com/docs/providers/github): HMAC over the raw body via X-Hub-Signature-256 — pair it with an idempotency store for replay protection.
- [Discord](https://webhooks-sdk.com/docs/providers/discord): Ed25519 signatures over timestamp + body — with a mode switch for Discord's two disagreeing products.
- [Twilio](https://webhooks-sdk.com/docs/providers/twilio): Twilio signs your public endpoint URL plus the sorted params — not the body — so the URL has to be right.
- [Google Pub/Sub](https://webhooks-sdk.com/docs/providers/google-pubsub): OIDC JWT verified against Google's JWKS — with the push envelope unwrapped so events arrive as events.
- [Standard Webhooks](https://webhooks-sdk.com/docs/providers/standard-webhooks): One spec, dozens of vendors — Resend, Clerk, Polar, Replicate ship as wrappers; everything else works generically.
- [Build a custom provider](https://webhooks-sdk.com/docs/providers/custom): Most providers are a description, not an implementation — createHmacProvider supplies the rest.