🔑 An NPM package to secure your Paddle webhooks

Hi Indie Hackers,

I created an NPM package that makes it super easy to secure your Paddle.com webhooks by verifying the payload signature.

I wanted to share this with the community here because I know a lot of us use Paddle but maybe not everyone has understood how to verify the webhooks payloads or the importance of doing it.

What is it for?

Use this in your webhook handlers to confirm the validity of requests, to ensure they are really being sent by Paddle and not spoofed or modified by some malicious 3rd party.

Who should use this?

Anybody using Paddle's webhooks! Nobody wants a malicious person to be able to spoof fake data into their webhook handler.

Why did I make it?

I am busy integrating Paddle into my SaaS project and wanted a lean-and-mean way to validate and secure my Paddle webhooks - but there wasn't one.

Their documentation on verifying webhooks gives some express.js example code which involves doing PHP-style serialization and funky string conversions. It felt overly complicated especially for any less experienced developers so I decided to create a simple NPM package that would save people time and lower the barrier-to-entry.

Can I use this in my [commercial] project?

Yup - It's MIT licensed so 100% free to use 👍