revenuecat-webhooks

RevenueCat Webhooks

When to Use This Skill

• How do I receive RevenueCat webhooks?
• How do I verify RevenueCat webhook signatures (X-RevenueCat-Webhook-Signature)?
• How do I check the RevenueCat webhook Authorization header?
• Why is my RevenueCat webhook signature verification failing?
• Handling subscription events like INITIAL_PURCHASE, RENEWAL, CANCELLATION, EXPIRATION or BILLING_ISSUE

Verification (core)

Caveat: HMAC signing is opt-in. It's only sent if you toggle HMAC webhook signing on the integration (the secret is shown once, at creation or rotation). Otherwise RevenueCat sends only the static Authorization header value you configured in the dashboard, and you must compare it to the expected value in constant time.

With signing on, every delivery carries:

X-RevenueCat-Webhook-Signature: t=<unix_timestamp>,v1=<hmac_sha256_hex>

v1 is HMAC-SHA256, hex encoded, over "<t>.<raw body>", keyed with the signing secret as a UTF-8 string. Verify the raw body bytes before parsing JSON, compare in constant time, and reject t more than 300 s from now (RevenueCat re-signs every retry, so t is always fresh).

const crypto = require('crypto');

// Signature (when REVENUECAT_WEBHOOK_SECRET is set)
const { t, v1 } = Object.fromEntries(
  (req.get('x-revenuecat-webhook-signature') || '').split(',').map((p) => {
    const i = p.indexOf('=');
    return [p.slice(0, i).trim(), p.slice(i + 1).trim()];
  })
);
const expected = crypto.createHmac('sha256', process.env.REVENUECAT_WEBHOOK_SECRET)
  .update(`${t}.`).update(rawBody).digest('hex');
const signatureOk = /^[0-9]+$/.test(t || '') && v1?.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected)) &&
  Math.abs(Date.now() / 1000 - Number(t)) <= 300;

// Authorization header (when REVENUECAT_WEBHOOK_AUTH is set): hash so lengths match
const h = (s) => crypto.createHash('sha256').update(s).digest();
const auth = req.get('authorization');
const authOk = !!auth && crypto.timingSafeEqual(h(auth), h(process.env.REVENUECAT_WEBHOOK_AUTH));