Svix Webhooks Skill

Svix is webhook-sending infrastructure used by many upstream services. If a provider delivers webhooks "powered by Svix" (or implements the Standard Webhooks spec), the verification below applies regardless of who the sender is.

When to Use This Skill

• How do I receive Svix webhooks?
• How do I verify svix-id / svix-timestamp / svix-signature headers?
• Why is my Svix webhook signature verification failing?
• How do I handle secret rotation (multiple v1, signatures in one header)?
• My provider says webhooks are "powered by Svix" / "Standard Webhooks" — how do I verify them?
• How do I parse the {"type": "...", "data": {...}} event envelope?

Verification (core)

Each request carries three headers:

svix-id: msg_2b1c...            # unique message id
svix-timestamp: 1614265330      # Unix seconds
svix-signature: v1,g0hM9SsE...  # space-delimited "v1,<base64 sig>" entries

The signed content is ${svix-id}.${svix-timestamp}.${raw_body}, HMAC-SHA256 using the base64-decoded bytes of the secret after the whsec_ prefix, and the result is base64-encoded. Use the official svix SDK — it handles the base64 secret, the 5-minute timestamp tolerance, multiple signatures (rotation), and constant-time comparison for you. Pass the raw body, never re-serialized JSON.

Node:

const { Webhook } = require('svix');

const wh = new Webhook(process.env.SVIX_WEBHOOK_SECRET); // "whsec_..." — SDK decodes it
const event = wh.verify(rawBody, {                       // rawBody: raw Buffer/string
  'svix-id': req.headers['svix-id'],
  'svix-timestamp': req.headers['svix-timestamp'],
  'svix-signature': req.headers['svix-signature'],
});
// Throws WebhookVerificationError on a bad signature or a timestamp >5 min off.
// The SDK also accepts webhook-id / webhook-timestamp / webhook-signature.
// event => { type: 'invoice.paid', data: { ... } }

Python:

from svix.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["SVIX_WEBHOOK_SECRET"])
event = wh.verify(raw_body, {                    # raw_body: bytes of the raw request body
    "svix-id": headers["svix-id"],
    "svix-timestamp": headers["svix-timestamp"],
    "svix-signature": headers["svix-signature"],
})  # raises WebhookVerificationError on failure; returns the parsed {type, data} dict

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

Svix does not define a fixed event catalog — the upstream service that sends through Svix defines its own event types. The near-universal convention is an envelope of {"type": "<event.name>", "data": {...}}. The examples below are illustrative of that convention; use your sender's App Portal / docs for the real list.

Because events are sender-defined, always keep a default branch that handles unknown type values gracefully.

Svix also emits its own Operational Webhooks (e.g. endpoint.disabled, message.attempt.exhausted) using this same scheme.

Environment Variables

# Signing secret for the endpoint — starts with whsec_
SVIX_WEBHOOK_SECRET=whsec_xxxxx

Get it from your sender's dashboard (Svix App Portal → Endpoints → Signing Secret).

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 svix --path /webhooks/svix

Reference Materials

• references/overview.md - Svix webhook concepts and the event envelope
• references/setup.md - Getting the signing secret and registering an endpoint
• references/verification.md - Signature verification details and gotchas