Next.js Webhooks

Protect your Next.js API routes with Relay and verify webhooks.

Verifying Webhooks

When Relay forwards a request to your API, it includes an x-relay-signature header. You can verify this signature in your Next.js App Router Route Handlers (e.g., app/api/webhook/route.ts) using Node.js's built-in crypto.verify method.

Below is a complete example of a Next.js App Router webhook endpoint that securely validates inbound requests from Relay.

A Next.js project using the App Router.
Your Relay Webhook Secret stored in process.env.RELAY_WEBHOOK_SECRET.

Copy// Next.js App Router Webhook Handler import { NextResponse } from 'next/server'; import crypto from 'crypto'; export async function POST(req: Request) { const payload = await req.text(); const signature = req.headers.get('x-relay-signature'); if (!signature) { return NextResponse.json({ error: 'Missing signature' }, { status: 401 }); } const secret = process.env.RELAY_WEBHOOK_SECRET; if (!secret) { return NextResponse.json({ error: 'Server configuration error' }, { status: 500 }); } const expectedSignature = crypto .createHmac('sha256', secret) .update(payload) .digest('base64'); const isVerified = crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expectedSignature) ); if (!isVerified) { return NextResponse.json({ error: 'Invalid signature' }, { status: 401 }); } // Process your verified webhook here return NextResponse.json({ success: true }); }