Verify webhooks in one call with the SDK

Every webhook Rendobar sends is signed, but verifying one used to mean rebuilding the signed string, reading two headers, and handling secret rotation by hand. The SDK now does all of it.

verifyWebhook(body, headers, secret) from @rendobar/sdk/webhooks takes the raw request body and the incoming headers, checks the HMAC signature over the timestamped payload, and rejects stale deliveries so a captured request can’t be replayed. During a secret rotation it accepts either the current or the previous secret. It returns a boolean and pulls in no runtime dependencies, so it runs on Node, Deno, Bun, Workers, and the browser.

import { verifyWebhook } from "@rendobar/sdk/webhooks";

const ok = await verifyWebhook(rawBody, req.headers, process.env.WEBHOOK_SECRET);
if (!ok) return new Response("invalid signature", { status: 401 });

Delivery behavior is documented in full now too. A delivery that doesn’t get a 2xx within 10 seconds retries up to 5 times with exponential backoff, and an endpoint that fails 10 times in a row is disabled automatically. The event catalog, retry schedule, and rotation flow live in the webhooks guide.

The helper ships in the client documented at SDK docs.