How to Test Discord Webhooks

{
  "type": 1,
  "data": {
    "name": "ping",
    "type": 1
  },
  "member": {
    "user": {
      "id": "123456789",
      "username": "developer"
    }
  },
  "channel_id": "987654321"
}

// npm i tweetnacl
import nacl from 'tweetnacl';
import express from 'express';

const PUBLIC_KEY = process.env.DISCORD_PUBLIC_KEY!; // hex string from Dev Portal

const app = express();

app.post(
  '/webhooks/discord',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-signature-ed25519'] as string | undefined;
    const timestamp = req.headers['x-signature-timestamp'] as string | undefined;
    if (!signature || !timestamp) {
      return res.status(401).send('missing signature headers');
    }

    const isValid = nacl.sign.detached.verify(
      Buffer.concat([Buffer.from(timestamp), req.body]),
      Buffer.from(signature, 'hex'),
      Buffer.from(PUBLIC_KEY, 'hex'),
    );

    if (!isValid) return res.status(401).send('invalid signature');

    const interaction = JSON.parse(req.body.toString('utf8'));
    // type 1 is PING — Discord uses it to verify the endpoint at registration
    if (interaction.type === 1) return res.json({ type: 1 });
    res.json({ type: 4, data: { content: 'ack' } });
  },
);

# pip install pynacl
import os
from nacl.signing import VerifyKey
from nacl.exceptions import BadSignatureError
from fastapi import FastAPI, Request, HTTPException

verify_key = VerifyKey(bytes.fromhex(os.environ['DISCORD_PUBLIC_KEY']))
app = FastAPI()

@app.post("/webhooks/discord")
async def discord_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get('x-signature-ed25519')
    timestamp = request.headers.get('x-signature-timestamp')
    if not signature or not timestamp:
        raise HTTPException(status_code=401, detail='missing signature headers')
    try:
        verify_key.verify(timestamp.encode() + body, bytes.fromhex(signature))
    except BadSignatureError:
        raise HTTPException(status_code=401, detail='invalid signature')
    import json
    payload = json.loads(body)
    if payload.get('type') == 1:  # PING
        return {'type': 1}
    return {'type': 4, 'data': {'content': 'ack'}}