Dub webhook signature verification: raw bodies and replays in Node.js

Before passing a Dub signup notification into the next task, verify the original request body and extract only the fields that task needs. This guide checks Dub-Signature and projects a lead.created event into a small work record with an offline example.

Sources checked October 22, 2026. We have not tested live Dub delivery, external database storage, or sending data to an AI service. Links to Dub are official links, with no referral ID. For the sending side, see conversion tracking; for building URLs, see UTM tracking.

#Decide what the next task needs

Suppose a signup starts a task to review a customer's onboarding. An AI does not need the entire notification. Our example keeps the event ID, type, creation time, event name, and your internal customer ID. It excludes the email address. A customer ID may still identify a person; check the destination's data-use terms before using real records.

Treat this record as evidence of a received signup event, without inferring payment or a confirmed commission. Give AI the source event ID, verified fields, and the next human review task separately. The sample only prints a record; it creates no tasks and sends no notifications.

#Dub configuration and signature format

The official introduction, fetched today, requires Business or above. Select a receiver URL and event types in Webhooks settings, then find the signing secret under Configuration. We did not create a webhook. Keep the secret in a server-side environment variable or equivalent, outside the browser, article, and Git.

The official verification guide calculates HMAC-SHA256 over the raw request body using the secret and compares it with the hex Dub-Signature header. Parsing with req.json() and serializing with JSON.stringify() may change whitespace or line breaks. Verify the original body obtained with await req.text().

Our Node.js/Bun example validates a 64-digit hex signature and uses timingSafeEqual on equal-length buffers. This is our local implementation, not an official SDK example.

const rawBody = await req.text()
const signature = req.headers.get('Dub-Signature')
// Import receiveLead from the downloadable file below.
const record = receiveLead(rawBody, signature, process.env.DUB_WEBHOOK_SECRET)

This fragment is not a complete HTTP handler. Add body-size limits, map exceptions to HTTP responses, and provide durable storage before production. A success response before persistence can leave a later processing failure unrecovered.

#Reproduce raw-body changes without credentials

Save dub-webhook-demo.mjs into an empty folder and run it with Bun or Node.js 22+. It signs synthetic input with a public demonstration key. It uses no network, credentials, or file storage.

bun dub-webhook-demo.mjs
# or
node dub-webhook-demo.mjs

Bun and Node produced identical output for this synthetic JSON:

A valid signature is followed by JSON and input checks: malformed JSON, unsupported events, and a missing customer ID are rejected. The official lead.created reference places id, event, createdAt, and data at the top level, with the customer inside data.customer. Our projection only accepts leads with an internal customer ID. It does not validate Dub's complete schema.

#Signature checks do not prevent replays

The replayAccepted: true result shows the limit: the same valid body and signature pass again. This example implements neither expiry checks nor persistent deduplication.

The introduction documents retries for non-2XX responses, with exponential backoff capped at 24 hours from the fifth retry. It also documents disabling a webhook after 20 consecutive failures. Do not treat delivery as unconditional and indefinite; inspect failures and responses in Event Logs.

For production, consider a persistent inbox with a unique event ID and a record of downstream task state. Return success after signature checks, input validation, and durable persistence; make subsequent processing resumable. We have not tested a database, queue, concurrent deliveries, event ordering, or live Dub delivery.

#What the experiment establishes

Local tests cover valid signatures, tampering, reserialization, missing/malformed signatures, a different key, signed invalid JSON, null, unsupported events, missing required values, and repeat acceptance. Synthetic tests do not establish service delivery guarantees or time savings.

For another receiving workflow, see Circleback webhooks. Find the examples in SaaS Workflows and the starter local demo. Use each product's own signature header and payload contract.