Verifying webhooks

verifyWebhook(body, headers, secret) checks a request's Standard Webhooks signature and age, and returns the parsed event. Pass the raw request body, exactly as received, and the endpoint's whsec_… signing secret (shown in the dashboard, or returned by coss.webhookEndpoints.create and rollSecret). While a rolled secret is in its grace period, requests verify with either the old or the new secret.

app/webhooks/coss/route.ts

import { ,  } from "coss";

export async function (: ) {
  try {
    const  = await (
      await .(),
      .,
      ..!,
    );

    if (. === "email.bounced") {
      .(.., ..bounce?.);                                                    
EmailEventData.bounce?: {
    type: "permanent" | "transient" | "undetermined";
    sub_type: string;
    diagnostic_code: string | null;
} | undefined
    }
    return new ("ok");
  } catch () {
    if ( instanceof ) {
      return new ("invalid signature", { : 400 });
    }
    throw ;
  }
}

Unlike every other SDK function, verifyWebhook throws: a failed signature check must not be ignorable. headers can be a Headers object or a plain Node-style record.

Requests older than 5 minutes (or from a clock more than 5 minutes off) are rejected. Change the window with toleranceSeconds:

const  = await (, , ..!, {
  : 600,
});

See Webhooks for event types, retries and ordering.