HMAC-SHA1 · hex · no timestamp

Vercel

Vercel integration webhooks, and one more SHA-1 holdout.

Try it — live, in your browser

import { verify } from "hooksig";

const result = await verify("vercel", {
  payload: rawBody,            // the RAW body, not parsed JSON
  headers: request.headers,
  secret: env.WEBHOOK_SECRET,
});

if (!result.verified) {
  return new Response(result.reason, { status: 400 });
}

The scheme

• Headerx-vercel-signature
• AlgorithmHMAC-SHA1
• Encodinghex
• Timestampnone — add your own if you need it
• SignsHMAC-SHA1 over the raw body, hex, keyed by the integration client secret. No timestamp.

Gotchas

• It is SHA-1, not SHA-256. Vercel and Twilio are the SHA-1 holdouts here.
• The header is the bare hex digest, no prefix.
• The key is your integration's client secret.
• No timestamp is signed, so add your own replay protection if needed.

Official Vercel docs →