sec-hmac-verify Edge Function — Security

sec-hmac-verify — Verify HMAC signatures (timing-safe)

Validates an HMAC-SHA256 or HMAC-SHA512 signature against a payload using crypto.subtle.verify — never vulnerable to timing attacks, never throws.

---

API

POST /api/sec-hmac-verify

Request body

Field	Type	Required	Default	Description
payload	string	✅	—	The original string that was signed
signature	string	✅	—	Hex-encoded HMAC signature to verify
secret	string	✅	—	Shared HMAC secret
algorithm	"SHA-256" | "SHA-512"	❌	"SHA-256"	Hash algorithm

Success response (200)

{
  "success": true,
  "data": {
    "valid": true
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing required field
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"payload": "webhook body", "signature": "abc123...", "secret": "webhook-secret"}'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    payload: rawBody,
    signature: req.headers['x-signature'],
    secret: WEBHOOK_SECRET,
  }),
});
const { data } = await response.json();
if (!data.valid) return new Response('Forbidden', { status: 403 });

Direct import (Node / Bun / Deno)

import { hmacVerify } from '@aerostack/functions/sec-hmac-verify';

const { valid } = await hmacVerify({
  payload: rawBody,
  signature: req.headers['x-signature'],
  secret: process.env.HMAC_SECRET!,
});

---

Use Cases

• Verifying incoming webhooks from Stripe, GitHub, Shopify, etc.
• Validating signed API requests in server-to-server communication
• Checking that email verification or password reset links haven't been tampered with
• Ensuring data integrity on cached or stored values

---

Notes

• Uses crypto.subtle.verify — timing-safe by design, prevents signature oracle attacks
• Never throws — all failure modes return { valid: false }
• Pair with sec-hmac-sign to produce signatures in the same hex format
• Always use sec-hmac-verify instead of string comparison for security