The Complete Production SOP: How to Deploy and Run Svix Enterprise Webhook Ingestion & Signature Verification in Autonomous AI Agents

---
name: "svix-webhook-signatures-dispatcher"
description: "Verify incoming webhook HMAC signatures and dispatch outbound webhooks with automated retries."
metadata:
  author: "Svix"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "verify svix webhook signature"
  - "prevent webhook replay attacks"
  - "svix webhook dispatcher"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

import { Webhook } from 'svix';
import type { Request, Response } from 'express';

export async function handleWebhook(req: Request, res: Response) {
  const payload = req.body; // Buffer from express.raw({ type: 'application/json' })
  const headers = {
    'svix-id': req.headers['svix-id'] as string,
    'svix-timestamp': req.headers['svix-timestamp'] as string,
    'svix-signature': req.headers['svix-signature'] as string,
  };

  if (!headers['svix-id'] || !headers['svix-timestamp'] || !headers['svix-signature']) {
    return res.status(400).json({ error: 'Missing required Svix headers' });
  }

  const wh = new Webhook(process.env.SVIX_WEBHOOK_SECRET!);
  try {
    const evt = wh.verify(payload, headers);
    return res.status(200).json({ received: true, event: evt });
  } catch (err) {
    return res.status(400).json({ error: 'Invalid webhook signature' });
  }
}