feat(sdk): add standardWebhooks.verify for Standard Webhooks (Svix) signature verification

[bobclarkdramisinfo]

Title : feat(sdk): add standardWebhooks.verify for Standard Webhooks (Svix) signature verification

---

Summary

Adds a standardWebhooks.verify helper to @trigger.dev/sdk that verifies webhook signatures following the Standard Webhooks spec — used by Stripe, GitHub, Slack, Linear, Shopify, Composio, Resend, Novu, Knock, Courier, ngrok, and most Svix-native providers.

The current verifyRequestSignature helper only covers single-header signature schemes (Stripe/GitHub/Cal.com/Novu style). Every user integrating Trigger.dev with a Standard Webhooks provider currently hand-rolls the same ~50 lines of crypto. This helper wraps a small spec-compliant verification function and re-uses the existing WebhookError shape.

What's in the change

• packages/trigger-sdk/src/v3/webhooks.ts — additive only:

  • standardWebhooks.verify(request, secret, options?) — verifies the composed signature, returns { payload, raw }
  • standardWebhooks.TOLERANCE_SECONDS = 300 (per the Standard Webhooks spec)
  • Header-name constants re-exported for convenience
  • Supports multi-signature entries (v1,a v1,b separated by space — accepts any one match)
  • Supports v1, v1a, v1b signature versions; throws WebhookError("unsupported signature version") otherwise
  • HMAC-SHA256 over ${webhook-id}.${webhook-timestamp}.${raw_body} with base64-decoded secret
  • timingSafeEqual compare (constant-time)
  • Configurable tolerance via { tolerance: 0 } to disable the anti-replay check

• packages/trigger-sdk/src/v3/webhooks.test.ts — 25 test cases covering happy path, all error modes, edge cases (boundary timestamps, multi-signature, empty secret, version variants).

• packages/trigger-sdk/src/v3/webhooks.test-fixtures.ts — known-good test vectors saved as constants, reviewable.

Usage

import { standardWebhooks } from "@trigger.dev/sdk";

const endpoint = client.defineHttpEndpoint({
  id: "composio",
  source: "composio.dev",
  verify: async (request) => {
    const { payload, raw } = await standardWebhooks.verify(
      request,
      process.env.COMPOSIO_WEBHOOK_SECRET!,
    );
    // payload: parsed JSON
    // raw: raw body string
    return { success: true };
  },
});

Why now

The Standard Webhooks spec keeps winning — Stripe and GitHub both migrated to it. Every new Standard Webhooks integration in Trigger.dev costs ~50 lines of crypto boilerplate. This closes the gap without absorbing integration logic (per the SDK's verifyRequestSignature design pattern).

Refs

• Issue: feat: first-class helper for Standard Webhooks (Svix) signature verification #4928
• Spec: https://www.standardwebhooks.com/
• Reference implementations: https://github.com/standard-webhooks/standard-webhooks

Checklist

• Single-issue PR
• No drive-by changes
• Format / lint / knip / build all pass locally
• Tests added (25 cases)
• No new dependencies
• Changeset (will add after sign-off — happy to follow your convention)
• "Allow edits from maintainers" enabled

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8523c55

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: b8f68179-13be-49f0-bbb1-47079a08239a

📥 Commits

Reviewing files that changed from the base of the PR and between 8b72e6c and 8523c55.

📒 Files selected for processing (3)

• packages/trigger-sdk/src/v3/webhooks.test-fixtures.ts
• packages/trigger-sdk/src/v3/webhooks.test.ts
• packages/trigger-sdk/src/v3/webhooks.ts

---

Walkthrough

Adds the exported standardWebhooks utility and related constants and types. The verifier checks required headers, decodes the secret, validates HMAC signatures and timestamps, and parses JSON bodies. Adds reusable signed-request fixtures and tests for successful verification, signature handling, header and secret errors, timestamp tolerance, malformed JSON, and non-object payloads.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Hi @bobclarkdramisinfo, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.