Agent-first·Zero-dependency·Web Crypto

Zero-dependency, edge-compatible webhook verification

Universal webhook signature verification and route handler toolkit built for agentic workflows and standard Web Cryptography (crypto.subtle). Never locks incoming request streams and prevents duplicate replay attacks across Next.js, Cloudflare Workers, Hono, Node.js, Bun, and Deno.

npm i @amirabaris/webhook-kit

Read Documentation GitHub

Quick ExampleNext.js / Web Standard Route Handler

app/api/webhook/route.tsZero Stream Lock

import { createWebhookHandler } from "@amirabaris/webhook-kit"

// Declarative route handler with automatic stream-cloning
export const POST = createWebhookHandler({
  provider: "stripe",
  secret: process.env.STRIPE_WEBHOOK_SECRET!,
  onEvent: async (event) => {
    // Verified event payload — request stream remains unconsumed
    console.log("Verified event:", event.type)
  },
})

Why webhook-kit?

Agentic Workflow & Guardrails

CLI command injects rules into AGENTS.md / CLAUDE.md so AI coding assistants never break webhooks by parsing JSON before signature checks.

Pure Web Cryptography

Powered by crypto.subtle with zero node:crypto or Buffer dependencies. Runs natively on Cloudflare Workers, Next.js Edge, Bun, Deno, and Node.

Zero Stream Lock

Uses request.clone() during verification. Original request body remains unconsumed (bodyUsed: false) for downstream parsers or proxies.

Replay Attack Defense

Built-in in-memory LRU or pluggable Redis/KV stores stop duplicate event execution when providers retry failed deliveries.

Ready to get started?

Check out the step-by-step documentation to set up verification in minutes.

Explore Docs