Installations

npm install verify-github-webhook-secret

Developer Guide

BETA

Typescript

No

Module System

ESM

Min. Node Version

>= 16.0.0

Node Version

18.16.1

NPM Version

9.5.1 Pull Requests

Open

4

Total

468

Closed

44

Merged

420

Issues

Open

1

Total

4

Closed

3

Releases

14

v3.0.2

Updated on Jul 18, 2023

v2.0.11

Updated on Jul 18, 2023

v3.0.1

Updated on Jul 16, 2023

v2.0.10

Updated on Jul 13, 2023

v2.0.9

Updated on Jan 27, 2023

v2.0.8

Updated on Oct 31, 2022

View All 14 releases

Languages

2

TypeScript

JavaScript

TypeScript (92.81%)

JavaScript (7.19%)

Developer

screendriver

Download Statistics

Total Downloads

0

Last Day

0

Last Week

0

Last Month

0

Last Year

0

GitHub Statistics

MIT License

3 Stars

1,648 Commits

2 Watchers

5 Branches

3 Contributors

Updated on Jul 13, 2025

Maintainers

1

View All 3 Contributors

Package Meta Information

Latest Version

3.0.2

Package Id

verify-github-webhook-secret@3.0.2

Unpacked Size

7.03 kB

Size

3.23 kB

File Count

9

NPM Version

9.5.1

Node Version

18.16.1

Published on

Jul 18, 2023

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

0%

NaN

Compared to previous day

Last Week

0%

NaN

Compared to previous week

Last Month

0%

NaN

Compared to previous month

Last Year

0%

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

2

micro tslib

Dev Dependencies

17

@ava/typescript @types/test-listen @typescript-eslint/eslint-plugin @typescript-eslint/parser auto-changelog ava c8 esbuild eslint eslint-config-prettier eslint-plugin-ava eslint-plugin-prettier got prettier release-it test-listen typescript

verify-github-webhook-secret

Verifies the secret that is sent in GitHub Webhooks. The secret will be used as the key to generate the HMAC hex digest value in the X-Hub-Signature header.

Installation 🏗

1$ npm install --save verify-github-webhook-secret

or if you use Yarn 🐈

1$ yarn add verify-github-webhook-secret

Usage 🔨

The exported function needs a http.IncomingMessage and your personal secret string. It returns a Promise that fulfills with a boolean if the received secret is valid or not.

You can use it for example with micro as follows:

1import micro from "micro";
2import { verifySecret } from "verify-github-webhook-secret";
3
4const server = micro(async (req) => {
5	const valid = await verifySecret(req, "my-secret");
6	return valid ? "Allowed" : "Not allowed";
7});

Another way to call the function is directly with the HTTP body and the x-hub-signature HTTP header. This is useful in an scenario where you don't have an IncomingMessage like in some serverless environments.

1import { verifySecret } from "verify-github-webhook-secret";
2
3async function myFunc() {
4	const valid = await verifySecret('{"foo":"bar"}', "my-secret", "sha1=30a233839fe2ddd9233c49fd593e8f1aec68f553");
5	return valid ? "Allowed" : "Not allowed";
6}

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

Score

4.4

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More