WebhookEndpoint

Popii

---

Popii / WebhookEndpoint

Interface: WebhookEndpoint

Defined in: plugins/webhook.ts:14

Methods

handle()

handle(payload, meta): void | Promise<void>

Defined in: plugins/webhook.ts:45

Called with the parsed JSON payload after successful verification.

Parameters

payload

any

meta

WebhookEndpointMeta

Returns

void | Promise<void>

Properties

path

path: string

Defined in: plugins/webhook.ts:16

URL path this endpoint listens on.

---

method?

optional method?: "GET" | "POST" | "PUT" | "PATCH"

Defined in: plugins/webhook.ts:18

HTTP method to accept. Defaults to “POST”.

---

rateLimit?

optional rateLimit?: object

Defined in: plugins/webhook.ts:23

Per-IP rate limit for this endpoint.

max

max: number

windowMs

windowMs: number

Example

rateLimit: { max: 10, windowMs: 60_000 } // 10 req/min

---

secret?

optional secret?: string

Defined in: plugins/webhook.ts:25

Shared secret used for HMAC verification.

---

algorithm?

optional algorithm?: "sha256" | "sha1" | "md5"

Defined in: plugins/webhook.ts:34

HMAC algorithm preset. Automatically reads the signature from the appropriate header and strips the common prefix:

• “sha256” → x-hub-signature-256, prefix “sha256=” (GitHub, Stripe, etc.)
• “sha1” → x-hub-signature, prefix “sha1=”
• “md5” → x-patreon-signature, no prefix (Patreon) Ignored if verify is provided.

---

signatureHeader?

optional signatureHeader?: string

Defined in: plugins/webhook.ts:36

Override which header carries the signature.

---

signaturePrefix?

optional signaturePrefix?: string

Defined in: plugins/webhook.ts:38

Prefix to strip from the signature header value before comparing.

---

verify?

optional verify?: (body, headers, secret) => boolean | Promise<boolean>

Defined in: plugins/webhook.ts:43

Custom verify function. Return false to reject with 401. Overrides algorithm/signatureHeader/signaturePrefix when provided.

Parameters

body

string

headers

Record<string, string>

secret

string

Returns

boolean | Promise<boolean>