Standardwebhooks

No REST API — Standard Webhooks is an open specification and SDK library. SDK usage: `npm install standardwebhooks` (or pip install standardwebhooks). Webhook verification: import Webhook from SDK; call wh.verify(payload, headers) with the webhook secret. The spec defines: webhook-id (unique message ID), webhook-timestamp (Unix timestamp), webhook-signature (one or more HMAC-SHA256 signatures). Signature computed as HMAC-SHA256(secret, '{webhook-id}.{webhook-timestamp}.{payload}'). Multiple signatures in webhook-signature header for secret rotation. No cloud service to call; entirely local library execution.

SDK verification: throws SignatureVerificationException (or equivalent per language) on invalid signature, timestamp out of tolerance, or malformed headers. No network calls — zero latency and no failure modes from external services. Replay attack window: 5-minute timestamp tolerance (adjustable). SDK is actively maintained (GitHub). Spec is stable. Provider adoption is growing (Svix, Clerk adopting). Fully offline/air-gapped compatible — no service dependency.

Standard Webhooks is an open specification — not a SaaS product. It defines a common webhook format (headers: webhook-id, webhook-timestamp, webhook-signature) and HMAC-SHA256 signature verification scheme to standardize how webhooks are sent and verified across providers. The project provides open-source SDKs in multiple languages that implement the spec. Value for agents: implement webhook signature verification once using the Standard Webhooks SDK, and it works with any provider that has adopted the spec (Svix, Clerk, and others). Reduces the need for per-provider custom verification logic. Confidence is docs-derived.

No API key or auth for the SDK itself (open source library). Webhook secret is a per-endpoint symmetric key provided by the sending service (e.g., Svix endpoint secret, Clerk webhook secret). Secret stored securely by the agent; never transmitted. Replay attack protection: webhook-timestamp must be within 5 minutes (configurable tolerance). No external service contact during verification — fully local HMAC computation. HTTPS is the sending service's responsibility.

standardwebhooks.com provides spec documentation, header definitions, signature computation details, and SDK getting started guides. SDKs available for Node.js, Python, Go, Java, Ruby, PHP, Rust, and others. Getting started: install SDK, obtain webhook secret from the sending service, call verify() in your webhook handler. Spec is open and free. GitHub: svix/standard-webhooks. No account required. Community via GitHub discussions.