Verify a delivery

Check a webhook delivery's signature server-side — for languages without a Standard Webhooks library. Send the raw body plus the svix-* header values; the response says whether the delivery is genuine.

If you're on JavaScript, prefer @lucerna-dev/webhooks — it verifies locally with no extra network hop.

POST /sdk/v1/waitlist/webhooks/verify

• Auth: None — the signing secret in the body is the proof.
• Always returns 200 when the request is well-formed. Use the verified field; act on the payload only when it is true.

Request body

Field	Type	Description
payload	string	The delivery's raw body, exactly as received (max 1 MB).
headers	object	{ id, timestamp, signature } — the svix-id, svix-timestamp and svix-signature header values.
webhookSecret	string	The endpoint's whsec_… signing secret.

Response

Field	Type	Description
verified	boolean	Whether the signature checks out.
event	object?	The parsed delivery payload, when verified.
reason	string?	Why verification failed, when not verified.

Example

curl -X POST https://api.uselucerna.app/sdk/v1/waitlist/webhooks/verify \
  -H "content-type: application/json" \
  -d '{
    "payload": "<raw request body>",
    "headers": {
      "id": "<svix-id header>",
      "timestamp": "<svix-timestamp header>",
      "signature": "<svix-signature header>"
    },
    "webhookSecret": "whsec_…"
  }'

{ "verified": true, "event": { "event": "signup.created", "…": "…" } }

Errors

Status	code	When
400	invalid_request	Missing fields or the payload exceeds 1 MB.

A wrong secret or forged signature is not an error — it returns 200 with { "verified": false, "reason": "…" }.