How to Test Vercel Webhooks

{
  "type": "deployment.succeeded",
  "payload": {
    "deployment": {
      "id": "dpl_abc123",
      "url": "my-app-abc123.vercel.app",
      "name": "my-app",
      "meta": {
        "githubCommitSha": "abc123def456"
      }
    }
  }
}

// Next.js App Router — read raw text, HMAC-SHA1, hex.
import crypto from 'node:crypto';

export async function POST(request: Request) {
  const signatureHeader = request.headers.get('x-vercel-signature');
  if (!signatureHeader) {
    return new Response('missing signature', { status: 401 });
  }

  const rawBody = await request.text();
  const expected = crypto
    .createHmac('sha1', process.env.VERCEL_WEBHOOK_SECRET!)
    .update(rawBody)
    .digest('hex');

  const sigBuf = Buffer.from(signatureHeader);
  const expBuf = Buffer.from(expected);
  if (
    sigBuf.length !== expBuf.length ||
    !crypto.timingSafeEqual(sigBuf, expBuf)
  ) {
    return new Response('invalid signature', { status: 403 });
  }

  const event = JSON.parse(rawBody);
  return Response.json({ ok: true, type: event.type });
}

import hmac, hashlib, os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post("/webhooks/vercel")
async def vercel_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get('x-vercel-signature', '')
    expected = hmac.new(
        os.environ['VERCEL_WEBHOOK_SECRET'].encode(),
        msg=body,
        digestmod=hashlib.sha1,  # NOTE: SHA-1, not SHA-256
    ).hexdigest()
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=403, detail='invalid signature')
    return {'ok': True}