Webhooks

Subscribe your services to MatterMesh events. We POST a JSON payload to your URL with an X-MatterMesh-Signature header (HMAC-SHA256 of the raw body using your signing secret).

Open the webhook inspector → to test deliveries with a capture URL.

New subscription

HTTPS endpoint that will receive event payloads.

Your subscriptions

Loading…

Verifying signatures

Every request includes X-MatterMesh-Signature assha256=<hex> of the raw body using your signing secret. Reject requests that don't match.

import crypto from "crypto";

function verify(rawBody, header, secret) {
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}