All packsTransactional Email Deliverability CoreSolve
svix webhook signature verification raw body nextjs route handler
Verify the signature before you look at the payload -- not after
A route that parses a webhook body before verifying its Svix signature can be tricked into doing database work on an unverified, possibly forged payload.
This is one of the things Transactional Email Deliverability Core already handles. Send transactional email that actually lands, and stop emailing people who bounce or complain.
Is this you?
If a webhook route parses the request body (to log it, to inspect the event type for routing) before checking its Svix signature, then an attacker who can reach the endpoint can send a forged payload that gets partially processed -- routed, logged, maybe used to decide which handler to call -- before the signature check ever runs and rejects it. The verification existing later in the function doesn't retroactively undo work already done on unverified input.
Why this one is easy to get wrong
Parsing the body first, to decide what kind of event it is and log it usefully, is a natural way to structure a webhook handler for readability and debugging -- signature verification reads as a step to add somewhere in the function, not necessarily as the literal first line before anything else touches the payload's contents.
What you get instead
The pack pins verify-before-anything-else as a named contract: verifyAndParse() runs first, handleEvent() only runs on success, and a bad or missing signature returns 401 with zero database writes. The route handler deliberately uses only Web-standard Request/Response (no next/server import) specifically so it stays directly invokable by the test that acts as the security gate: verify.sh fails any build whose route parses before verifying.
Source: ARCHITECTURE.md 'Webhooks (Resend -> Svix transport)', decision 6-7 — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 13 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
3 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →