# Svix Webhooks

Svix is webhook-sending infrastructure used by many upstream services. If a
provider delivers webhooks "powered by Svix" (or implements the
[Standard Webhooks](https://www.standardwebhooks.com/) spec), the verification
below applies regardless of who the sender is.

## When to Use This Skill

* How do I receive Svix webhooks?
* How do I verify `svix-id` / `svix-timestamp` / `svix-signature` headers?
* Why is my Svix webhook signature verification failing?
* How do I handle secret rotation (multiple `v1,` signatures in one header)?
* My provider says webhooks are "powered by Svix" / "Standard Webhooks" — how do I verify them?
* How do I parse the `{"type": "...", "data": {...}}` event envelope?

## Verification (core)

Each request carries three headers:

```
svix-id: msg_2b1c...            # unique message id
svix-timestamp: 1614265330      # Unix seconds
svix-signature: v1,g0hM9SsE...  # space-delimited "v1,<base64 sig>" entries

```

The signed content is `${svix-id}.${svix-timestamp}.${raw_body}`, HMAC-SHA256
using the base64-decoded bytes of the secret after the `whsec_` prefix, and
the result is base64-encoded. Use the official `svix` SDK — it handles the
base64 secret, the 5-minute timestamp tolerance, multiple signatures (rotation),
and constant-time comparison for you. Pass the raw body, never re-serialized JSON.

Node:

```javascript
const { Webhook } = require('svix');

const wh = new Webhook(process.env.SVIX_WEBHOOK_SECRET); // "whsec_..." — SDK decodes it
const event = wh.verify(rawBody, {                       // rawBody: raw Buffer/string
  'svix-id': req.headers['svix-id'],
  'svix-timestamp': req.headers['svix-timestamp'],
  'svix-signature': req.headers['svix-signature'],
});
// Throws WebhookVerificationError on a bad signature or a timestamp >5 min off.
// The SDK also accepts webhook-id / webhook-timestamp / webhook-signature.
// event => { type: 'invoice.paid', data: { ... } }

```

Python:

```python
from svix.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["SVIX_WEBHOOK_SECRET"])
event = wh.verify(raw_body, {                    # raw_body: bytes of the raw request body
    "svix-id": headers["svix-id"],
    "svix-timestamp": headers["svix-timestamp"],
    "svix-signature": headers["svix-signature"],
})  # raises WebhookVerificationError on failure; returns the parsed {type, data} dict

```

> For complete handlers with route wiring, event dispatch, and tests, see:
> 
> * [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/svix-webhooks/examples/express/)
> * [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/svix-webhooks/examples/nextjs/)
> * [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/svix-webhooks/examples/fastapi/)

## Common Event Types

Svix does not define a fixed event catalog — the upstream service that
sends through Svix defines its own event types. The near-universal convention is
an envelope of `{"type": "<event.name>", "data": {...}}`. The examples below are
illustrative of that convention; use your sender's App Portal / docs for the real
list.

| Event (illustrative) | Envelope |
| --- | --- |
| `invoice.paid` | `{"type": "invoice.paid", "data": { "id": "..." }}` |
| `user.created` | `{"type": "user.created", "data": { "id": "..." }}` |
| `user.updated` | `{"type": "user.updated", "data": { "id": "..." }}` |
| `message.sent` | `{"type": "message.sent", "data": { "id": "..." }}` |

Because events are sender-defined, always keep a `default` branch that handles
unknown `type` values gracefully.

> Svix also emits its own [Operational Webhooks](https://docs.svix.com/incoming-webhooks)
> (e.g. `endpoint.disabled`, `message.attempt.exhausted`) using this same scheme.

## Environment Variables

```bash
# Signing secret for the endpoint — starts with whsec_
SVIX_WEBHOOK_SECRET=whsec_xxxxx

```

Get it from your sender's dashboard (Svix App Portal → Endpoints → Signing Secret).

## Local Development

```bash
# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 svix --path /webhooks/svix

```

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/svix-webhooks/references/overview.md) - Svix webhook concepts and the event envelope
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/svix-webhooks/references/setup.md) - Getting the signing secret and registering an endpoint
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/svix-webhooks/references/verification.md) - Signature verification details and gotchas