Verify Discord webhooks

​

Get the public key

​

Register it on your endpoint

# read from a no-echo prompt (or piped stdin) — never an argv flag
printf %s "$DISCORD_PUBLIC_KEY" | wbhk endpoints add-provider-secret <endpoint-id> \
  --provider discord

curl https://api.webhook.co/v1/endpoints/<endpoint-id>/provider-secrets \
  -H "Authorization: Bearer $WEBHOOK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"provider":"discord","secret":"<your-value>"}'

await webhook.endpoints.providerSecrets.add({
  endpointId,
  provider: "discord",
  secret: process.env.DISCORD_PUBLIC_KEY!,
});

​

How the signature is checked

• Signed message — {timestamp}{rawBody} — the timestamp header concatenated to the raw body, no separator.
• Algorithm — Ed25519, hex-encoded.
• Key — registered secret is the app’s hex-encoded 32-byte Ed25519 public key, used verbatim.
• Signature format — hex-encoded 64-byte Ed25519 signature.
• Timestamp — read from the x-signature-timestamp header.

​

What makes this one different

• The registered “secret” is Discord’s hex-encoded 32-byte Ed25519 PUBLIC key, not a shared secret.
• Timestamp and body are concatenated with NO separator ({timestamp}{body}).
• The signed timestamp is bound into the message but no replay-age window is enforced — the signature is the authenticity guarantee; downstream dedupe handles replay.

​

Confirm

wbhk events list <endpoint-id> --status verified