> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nika.sh/llms.txt
> Use this file to discover all available pages before exploring further.
# Webhooks
> Verify timestamped HMAC-SHA256 signatures against the raw request body.
export const RemoteContract = () =>
Preview surface. The root package types the intended
workflow HTTP and SSE API. The reference engine does not ship a compatible
workflow service today. Do not point it at the stable resident firer or
nika model serve.
;
The signature verifier is a shipped SDK utility. The service that would send
workflow webhooks remains on the preview horizon.
## Preserve the raw body
```ts theme={"system"}
const rawBody = await request.text()
const signature = request.headers.get('X-Nika-Signature') ?? ''
const valid = await Nika.verifyWebhook(
rawBody,
signature,
process.env.NIKA_WEBHOOK_SECRET!,
)
```
The signed payload is `.`. Verify before JSON parsing;
parse and reserialization can change bytes.
## Reject before dispatch
```ts theme={"system"}
if (!valid) {
return new Response('invalid signature', { status: 401 })
}
const event = JSON.parse(rawBody)
await dispatch(event)
```
The header shape is `t=,v1=`. The verifier:
* refuses malformed fields;
* refuses timestamps outside the tolerance;
* computes HMAC-SHA256 with Web Crypto;
* compares equal-length signatures in constant time.
Pass a fourth argument to change the default tolerance:
```ts theme={"system"}
await Nika.verifyWebhook(rawBody, signature, secret, 60)
```
## Test without a service
Build fixture signatures with Web Crypto in application tests. Keep replay
tests for stale timestamps, modified bodies, wrong secrets and malformed
headers.
## Continue
Keep secrets and trust transitions explicit.
Decide how invalid delivery reaches product state.
Read the remote event and error shapes.
Inspect the exact verifier.