{"repo":"eben-vranken/trusthook","free":true,"listed":false,"github":"https://github.com/eben-vranken/trusthook","clone":"git clone https://github.com/eben-vranken/trusthook.git","description":"🪝 One-call webhook signature verification for any provider, with replay protection and zero dependencies.","language":"Go","stars":12,"topics":["discord","github-webhooks","go","golang","hmac","signature-verification","slack","stripe","webhook","webhook-verification"],"license":"MIT","category":"chat-messaging","readme_excerpt":"Trusthook One-call webhook signature verification for any provider, with replay protection and zero dependencies. One API to verify inbound webhook signatures from any provider: Stripe, GitHub, Shopify, Slack, Discord, and more. Pure Go stdlib, zero dependencies. Every provider signs webhooks differently (hex vs. base64, HMAC vs. Ed25519, raw body vs. timestamped strings), and getting any detail wrong silently breaks verification or, worse, leaves your endpoint forgeable. Trusthook handles the per-provider quirks, replay protection, and constant-time comparison behind a single call. Install Usage Pick a provider, pass the raw body, the request headers, and your signing secret. Trusthook returns nil when the signature is valid, or an error when it is not. To support a different provider, change the provider value. Nothing else changes. Supported providers Provider Scheme --- --- Stripe HMAC-SHA256 (timestamped) GitHub HMAC-SHA256 (hex) Shopify HMAC-SHA256 (base64) Slack HMAC-SHA256 (timestamped) Paddle HMAC-SHA256 (timestamped) Discord Ed25519 Standard Webhooks HMAC-SHA256 Dropbox HMAC-SHA256 (hex) Lemon Squeezy HMAC-SHA256 (hex) Linear HMAC-SHA256 (hex) Coinbase Commerce HMAC-SHA256 (hex) Razorpay HMAC-SHA256 (hex) Zoom HMAC-SHA256 (timestamped) Calendly HMAC-SHA256 (timestamped) WorkOS HMAC-SHA256 (timestamped) Svix HMAC-SHA256 (Standard Webhooks) Clerk HMAC-SHA256 (Standard Webhooks) Resend HMAC-SHA256 (Standard Webhooks) Errors Verify returns a sentinel error you can match","default_branch":null,"files":null,"tree":[],"storefront":"/r/eben-vranken","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/eben-vranken/trusthook/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}