svix-webhooks

Svix Webhooks

Svix is webhook-sending infrastructure used by many upstream services. If a provider delivers webhooks "powered by Svix" (or implements the Standard Webhooks spec), the verification below applies regardless of who the sender is.

When to Use This Skill

• How do I receive Svix webhooks?
• How do I verify svix-id / svix-timestamp / svix-signature headers?
• Why is my Svix webhook signature verification failing?
• How do I handle secret rotation (multiple v1, signatures in one header)?
• My provider says webhooks are "powered by Svix" / "Standard Webhooks" — how do I verify them?
• How do I parse the {"type": "...", "data": {...}} event envelope?

Verification (core)

Each request carries three headers:

svix-id: msg_2b1c...            # unique message id
svix-timestamp: 1614265330      # Unix seconds
svix-signature: v1,g0hM9SsE...  # space-delimited "v1,<base64 sig>" entries

The signed content is ${svix-id}.${svix-timestamp}.${raw_body}, HMAC-SHA256 using the base64-decoded bytes of the secret after the whsec_ prefix, and the result is base64-encoded. Use the official svix SDK — it handles the base64 secret, the 5-minute timestamp tolerance, multiple signatures (rotation), and constant-time comparison for you. Pass the raw body, never re-serialized JSON.

Node:

const { Webhook } = require('svix');

const wh = new Webhook(process.env.SVIX_WEBHOOK_SECRET); // "whsec_..." — SDK decodes it
const event = wh.verify(rawBody, {                       // rawBody: raw Buffer/string
  'svix-id': req.headers['svix-id'],
  'svix-timestamp': req.headers['svix-timestamp'],
  'svix-signature': req.headers['svix-signature'],
});
// Throws WebhookVerificationError on a bad signature or a timestamp >5 min off.
// The SDK also accepts webhook-id / webhook-timestamp / webhook-signature.
// event => { type: 'invoice.paid', data: { ... } }

Python:

from svix.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["SVIX_WEBHOOK_SECRET"])
event = wh.verify(raw_body, {                    # raw_body: bytes of the raw request body
    "svix-id": headers["svix-id"],
    "svix-timestamp": headers["svix-timestamp"],
    "svix-signature": headers["svix-signature"],
})  # raises WebhookVerificationError on failure; returns the parsed {type, data} dict