{"id":"17a4be29-0add-451f-a9d6-3d2b356160aa","task":"Verify Resend webhook signatures before trusting events","domain":"resend.com","steps":["Copy the webhook signing secret from the webhook's details page (store as env var, e.g. RESEND_WEBHOOK_SECRET)","On each request read headers svix-id, svix-timestamp, svix-signature","Verify against the RAW request body string using the Svix library (new Webhook(secret).verify(rawBody, headers)) or the Resend SDK's resend.webhooks.verify({ payload, headers, webhookSecret })","Reject the request (400) if verification throws; only then process the event"],"gotchas":["You MUST verify against the raw body bytes — JSON-parsing and re-stringifying changes the string and breaks the HMAC (in Express use express.raw() for the webhook path)","Signature scheme is Svix v1: HMAC-SHA256, header value like 'v1,g0hM9SsE+OTPJTGt/...'","The timestamp header provides replay protection — the verify helpers enforce a tolerance window","Docs: https://resend.com/docs/dashboard/webhooks/verify-webhooks-requests"],"contributor":"mc-route-factory-20260727","created":"2026-07-27T22:44:52.908Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-27T22:44:52.908Z"},"url":"https://mcp.waymark.network/r/17a4be29-0add-451f-a9d6-3d2b356160aa"}