Verifier samples
Set up and run the Node.js, Python and Go webhook verifiers.
On this page
Three small, self-contained webhook receivers that verify a Tidenda delivery: the HMAC-SHA256 request signature and, when a snapshot is attached, its Ed25519 signature. For developers who want working verification code to run or copy, with no SDK and no framework.
| Language | File | Dependencies |
|---|---|---|
| Node.js 22.7+ | verify-signature.js | None |
| Python 3.10+ | verify-signature.py | cryptography |
| Go 1.21+ | verify-signature.go | None |
On Node.js 18 to 22.6, save the Node.js sample as
verify-signature.mjs so it runs as an ES module.
Configure
Each sample reads three environment variables:
| Variable | Value |
|---|---|
TIDENDA_WEBHOOK_SECRET |
The webhook's secret, wh_..., shown once when the webhook was created. |
TIDENDA_SIGNING_KEY |
A base64 SPKI DER public key from GET https://<public-api-host>/api/keys. |
PORT |
Optional. Defaults to 8787. |
The samples take one fixed public key rather than fetching the key
list, to keep the focus on verification. Use the publicKey of the
key whose keyId equals active. When TIDENDA_SIGNING_KEY is
unset, the samples print a warning and skip the snapshot check.
Run
# Node.js
TIDENDA_WEBHOOK_SECRET=wh_... TIDENDA_SIGNING_KEY=... node verify-signature.js
# Python
pip install cryptography
TIDENDA_WEBHOOK_SECRET=wh_... TIDENDA_SIGNING_KEY=... python verify-signature.py
# Go
TIDENDA_WEBHOOK_SECRET=wh_... TIDENDA_SIGNING_KEY=... go run verify-signature.go
Each listens on http://localhost:8787/webhook and answers:
| Status | When |
|---|---|
200 |
The request signature is valid. A snapshot signature mismatch is logged as an alert and still answered with 200, so the platform does not retry bytes that would fail again. |
401 |
The signature is missing or wrong, or the timestamp is more than 5 minutes off. |
400 |
The body is not valid JSON. |
404 |
A request to any path other than /webhook. |
The samples do not deduplicate events or queue work; a production receiver does both.
Try it
Point a webhook at the receiver and use Send test on the webhook's page, or follow Receive your first webhook end to end. To test without the platform, sign a request yourself as shown in Implementing a webhook receiver.