[mayankbohradev]

What

resend webhooks listen now checks each request's Svix signature before it prints or forwards the event. It also shows the temporary webhook's signing secret.

Why

The listener accepted any POST that reached the tunnel, so it could print or forward forged events. Apps behind --forward-to received the Svix headers but had no secret to check them with.

How

• Verify the raw body with resend.webhooks.verify and the secret returned by webhooks.create. Missing or invalid signatures get HTTP 400 and are not printed or forwarded.
• Return HTTP 503 if a request arrives before the temporary webhook exists.
• Show the secret in the banner. In JSON mode, the first line is {"object":"webhook","id":"...","signing_secret":"..."}, the same shape webhooks create returns. Event lines follow.
• No body limit, bind address or new flags. server.listen(port) is unchanged.

Testing

• Tests use real HMAC signatures and the real SDK verifier: valid delivery, missing signature, invalid signature, the JSON startup line and the banner.
• pnpm test (1,472 passed, 1 skipped), pnpm typecheck, pnpm lint, pnpm build.

Notes for reviewers

• JSON-mode consumers see one extra first line. It has object instead of type, so it can't be read as an event.
• README and skills/resend-cli/references/webhooks.md are updated.
• Updates the earlier proposal in fix: verify Svix signatures before forwarding webhook payloads #224.

Review

Local Codex review (GPT-6.1-Sol, medium): no findings.

[dielduarte]

Hey @mayankbohradev Thanks for picking this up again. Checking the signature before printing or forwarding is the right fix, and reusing resend.webhooks.verify with the secret from webhooks.create keeps it small. Before we merge, I'd like to cut the scope back to that.

Please drop:

• RESEND_WEBHOOK_MAX_BODY_BYTES. Resend webhook payloads are small, and we don't want a setting nobody will use. If you keep a body limit, make it a hardcoded constant. maxBodyBytesFromEnv and the invalid_body_limit error can then go.
• --host and the switch to binding 127.0.0.1. The listener is public through the tunnel by design, so binding to loopback only blocks traffic from the local network. Once signatures are checked, that adds very little, and it changes how the command behaves today (all interfaces, IPv6 included). For example, someone whose tunnel runs in Docker would break. Please keep server.listen(port) as it is.
• The tests that go with those two changes. binds to loopback by default checks option.defaultValue and returns early when there's no non-loopback interface, so it probably never tests anything in CI. supports an explicit bind host would pass on main too.

Please keep:

• The signature check and the missing-signature and invalid-signature tests. Asserting the request was never forwarded and nothing was logged is the right thing to test.
• Moving the test mock to extend the real Resend class.
• The 503 while setup is still running is fine.

Please add:

• the temporary webhook's signing secret is never shown, so apps behind --forward-to can't check the Svix headers we pass along. Printing it in the banner and including it in JSON mode would fix that.

[mayankbohrajaipuria]

Posted from my other account by mistake. The body limit mentioned here is now removed too — see my reply below and the updated PR description.

[dielduarte]

• RESEND_WEBHOOK_MAX_BODY_BYTES, maxBodyBytesFromEnv and the invalid_body_limit error. The body limit is now a fixed 1 MiB constant. Larger requests still get 413 and the connection closes.

Sorry @mayankbohradev the first message was not clear on the body limit cap, I don't think we want this in this PR. can u please remove too?

[mayankbohradev]

can u please remove too?

No problem, @dielduarte. Done in 64f4b3a.

Removed

• The fixed 1 MiB body limit, PayloadTooLargeError and the 413 response. readBody now matches main.
• The oversized-body test and its chunked-request helper.
• The body-limit lines in the README and the command help.

What the PR now changes

• It verifies the Svix signature before it prints or forwards an event. Missing or invalid signatures get 400.
• It returns 503 while the temporary webhook is still being created.
• It shows the signing secret in the banner. In JSON mode, the first line is {"object":"webhook","id":"...","signing_secret":"..."}.

pnpm test (1,472 passed, 1 skipped), pnpm typecheck, pnpm lint and pnpm build all pass locally.

[dielduarte]

can u please remove too?

No problem, @dielduarte. Done in 64f4b3a.

Removed

• The fixed 1 MiB body limit, PayloadTooLargeError and the 413 response. readBody now matches main.
• The oversized-body test and its chunked-request helper.
• The body-limit lines in the README and the command help.

What the PR now changes

• It verifies the Svix signature before it prints or forwards an event. Missing or invalid signatures get 400.
• It returns 503 while the temporary webhook is still being created.
• It shows the signing secret in the banner. In JSON mode, the first line is {"object":"webhook","id":"...","signing_secret":"..."}.

pnpm test (1,472 passed, 1 skipped), pnpm typecheck, pnpm lint and pnpm build all pass locally.

I've decided to drop that first line too, it would expose the key in environments that are not dev enviroments like CI, polluting stdout as well. Already approved, thanks for the contribution!