Skip to main content
Every webhook request includes three Svix headers:

Verify in Node

Verify in Python

Replay protection

The svix-timestamp is enforced ±5 minutes. Old replays are rejected automatically.
Always verify on the raw request body, not a parsed JSON object. Any reformatting will break the signature.