Verifying requests
Check the signature on every call Storeware makes to your app.
import { ... } from '@storeware/plugin-sdk';verifySignedRequest
Verifies any signed request from Storeware and returns its parsed body.
function verifySignedRequest<T = unknown>(options: VerifySignedRequestOptions): Promise<T>verifyWebhook
Verifies a webhook delivery and returns the parsed event.
function verifyWebhook<T = unknown>(options: VerifyWebhookOptions): Promise<StorewareEvent<T>>WebhookVerificationError
new WebhookVerificationError(reason: string)StorewareEvent
| Name | Type | Description |
|---|---|---|
id | string | |
event | string | Versioned, for example product.created.v1. |
storeId | string | null | |
createdAt | string | |
data | T |
VerifyWebhookOptions
| Name | Type | Description |
|---|---|---|
secret | string | The secret handed to your plugin when a merchant installed it. |
rawBody | string | The raw request body, exactly as received. |
signatureHeader | string | null | undefined | |
toleranceSeconds? | number | |
nowSeconds? | number |
SignedRequestKind
What a signed request from Storeware is for. Matches the platform's list.
type SignedRequestKind = 'webhook' | 'tool' | 'knowledge' | 'block' | 'proxy' | 'action' | 'lifecycle' | 'rates';VerifySignedRequestOptions
| Name | Type | Description |
|---|---|---|
kind | SignedRequestKind | The kind this endpoint serves. A request signed as anything else fails. |
secret | string | The secret handed to your plugin when a merchant installed it. |
rawBody | string | The raw request body, exactly as received. |
signatureHeader | string | null | undefined | |
toleranceSeconds? | number | |
nowSeconds? | number |
SIGNATURE_HEADER
const SIGNATURE_HEADER: 'storeware-signature'DEFAULT_TOLERANCE_SECONDS
const DEFAULT_TOLERANCE_SECONDS: 300KIND_HEADER
const KIND_HEADER: 'storeware-kind'INSTALLATION_HEADER
The installation a signed request is for, so an app knows whose secret to verify it with before reading the body. Not signed: naming the wrong one only picks a secret that fails.
const INSTALLATION_HEADER: 'storeware-installation'