# Verifying requests

> Check the signature on every call Storeware makes to your app.

Source: https://storeware.ai/docs/sdk/webhooks

```ts
import { ... } from '@storeware/plugin-sdk';
```

### verifySignedRequest

Verifies any signed request from Storeware and returns its parsed body.

```ts
function verifySignedRequest<T = unknown>(options: VerifySignedRequestOptions): Promise<T>
```

### verifyWebhook

Verifies a webhook delivery and returns the parsed event.

```ts
function verifyWebhook<T = unknown>(options: VerifyWebhookOptions): Promise<StorewareEvent<T>>
```

### WebhookVerificationError

```ts
new WebhookVerificationError(reason: string)
```

### StorewareEvent

| Name | Type | Description |
| --- | --- | --- |
| `id` | `string` |  |
| `event` | `string` | Versioned, for example `product.created.v1`. |
| `storeId` | `string \| null` |  |
| `createdAt` | `string` |  |
| `data` | `T` |  |

### VerifyWebhookOptions

| Name | Type | Description |
| --- | --- | --- |
| `secret` | `string` | The secret handed to your plugin when a merchant installed it. |
| `rawBody` | `string` | The raw request body, exactly as received. |
| `signatureHeader` | `string \| null \| undefined` |  |
| `toleranceSeconds?` | `number` |  |
| `nowSeconds?` | `number` |  |

### SignedRequestKind

What a signed request from Storeware is for. Matches the platform's list.

```ts
type SignedRequestKind = 'webhook' | 'tool' | 'knowledge' | 'block' | 'proxy' | 'action' | 'lifecycle' | 'rates';
```

### VerifySignedRequestOptions

| Name | Type | Description |
| --- | --- | --- |
| `kind` | `SignedRequestKind` | The kind this endpoint serves. A request signed as anything else fails. |
| `secret` | `string` | The secret handed to your plugin when a merchant installed it. |
| `rawBody` | `string` | The raw request body, exactly as received. |
| `signatureHeader` | `string \| null \| undefined` |  |
| `toleranceSeconds?` | `number` |  |
| `nowSeconds?` | `number` |  |

### SIGNATURE_HEADER

```ts
const SIGNATURE_HEADER: 'storeware-signature'
```

### DEFAULT_TOLERANCE_SECONDS

```ts
const DEFAULT_TOLERANCE_SECONDS: 300
```

### KIND_HEADER

```ts
const KIND_HEADER: 'storeware-kind'
```

### INSTALLATION_HEADER

The installation a signed request is for, so an app knows whose secret to verify it with before reading the body. Not signed: naming the wrong one only picks a secret that fails.

```ts
const INSTALLATION_HEADER: 'storeware-installation'
```