JavaScript

GitHub webhook with Node.js + Express

Use express.raw on this route: express.json running before it changes the bytes signed by GitHub.

Code sample

Webhook endpoint

Code samples, header names, event names, and signatures remain verbatim across locales.

import crypto from 'node:crypto';
import express from 'express';

const app = express();
app.post('/webhooks/github', express.raw({ type: 'application/json' }), (req, res) => {
  const sent = req.get('X-Hub-Signature-256') ?? '';
  const expected = `sha256=${crypto.createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET)
    .update(req.body).digest('hex')}`;
  const valid = sent.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected));
  if (!valid) return res.sendStatus(401);

  queue.add({ deliveryId: req.get('X-GitHub-Delivery'), event: req.get('X-GitHub-Event'),
    payload: JSON.parse(req.body.toString('utf8')) });
  return res.sendStatus(202);
});

Setup steps

Verify the first delivery

Setup steps 1

Create a workspace in DevLog and copy the endpoint and Secret.

Setup steps 2

Configure the same Secret in GitHub and in your application’s secure environment variable.

Setup steps 3

Send a ping and confirm the signature, Delivery ID, and payload in the inbox.

Start free User guide