Vellum Webhook Signature Verifier (http/vellum-signature.ts)

Verifies HMAC-SHA256 signatures and timestamps for incoming Vellum webhooks and WebSocket handshakes. Use it to secure API endpoints against unauthorized requests.

// Source: https://github.com/vellum-ai/vellum-assistant | License: MIT | Copyright 2025 Vellum AI
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Verification for the `Vellum-Signature` header.
 *
 * The signer computes `HMAC-SHA256(secret, rawBody)` and sends it as
 * `Vellum-Signature: sha256=<hex-digest>`. The scheme is the platform's, but
 * nothing about it is platform-specific — plugin webhook routes verify the
 * same header against the plugin's own secret.
 */

import { createHmac, timingSafeEqual } from "node:crypto";

const HEADER_NAME = "vellum-signature";
const PREFIX = "sha256=";

/** Companion header carrying the unix seconds a handshake was signed at. */
export const VELLUM_TIMESTAMP_HEADER = "vellum-timestamp";

/**
 * How stale a signed handshake m

... (truncated -- full source via MCP)