@octokit/webhooks-methods
v5.1.0webhooks-methods.js
Methods to handle GitHub Webhook requests
Table of contents
usage
Browsers |
🚧 Load
|
---|---|
Node |
Install with
|
await sign("mysecret", eventPayloadString);
// resolves with a string like "sha256=4864d2759938a15468b5df9ade20bf161da9b4f737ea61794142f3484236bda3"
await sign({ secret: "mysecret", algorithm: "sha1" }, eventPayloadString);
// resolves with a string like "sha1=d03207e4b030cf234e3447bac4d93add4c6643d8"
await verify("mysecret", eventPayloadString, "sha256=486d27...");
// resolves with true or false
await verifyWithFallback("mysecret", eventPayloadString, "sha256=486d27...", ["oldsecret", ...]);
// resolves with true or false
Methods
sign()
await sign(secret, eventPayloadString);
await sign({ secret, algorithm }, eventPayloadString);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
algorithm
(String)
|
Algorithm to calculate signature. Can be set to Learn more at Validating payloads from GitHub |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
Resolves with a signature
string. Throws an error if an argument is missing.
verify()
await verify(secret, eventPayloadString, signature);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
signature
(String)
|
Required.
Signature string as calculated by sign() .
|
Resolves with true
or false
. Throws error if an argument is missing.
verifyWithFallback()
await verifyWithFallback(
secret,
eventPayloadString,
signature,
additionalSecrets,
);
secret
(String)
|
Required. Secret as configured in GitHub Settings. |
eventPayloadString
(String)
|
Required.
Webhook request payload as received from GitHub. If you have only access to an already parsed object, stringify it with JSON.stringify(payload)
|
signature
(String)
|
Required.
Signature string as calculated by sign() .
|
additionalSecrets
(Array of String)
|
If given, each additional secret will be tried in turn. |
This is a thin wrapper around verify()
that is intended to ease callers' support for key rotation.
Resolves with true
or false
. Throws error if a required argument is missing.
Contributing
See CONTRIBUTING.md
License
Metadata
- MIT
- >= 18
- Gregor Martynus
- released 4/4/2024