Free · MIT licensed · no signup

Verify a Creem webhook before you trust it.

A small Cloudflare Worker that verifies HMAC-SHA256 over the original request bytes, then checks the event and order fields it uses. No customer or order data is logged by the handler.

Current source snapshot: f248ddc. Free to read and download without an account or email address.

Run the checks without an account

1. Download and unzip the snapshot, then open its extracted directory.
2. With Node 22 or later, run node --no-warnings test.mjs.
3. Expect 49 checks passed (offline logic). These use public synthetic values; they do not make a payment or deliver a purchase.

The README for this snapshot includes local Workers runtime checks and separate test/live Worker, webhook and secret setup. Real deployment needs your own account and endpoint signing secrets.

View automated checks for this snapshot: 49 offline checks and 40 local Workers HTTP checks. The run used synthetic data in a temporary CI runner. Payment and delivery integration must be tested separately.

What this example does

It authenticates raw bytes before UTF-8/JSON parsing, limits the incoming body to 65,536 bytes as an example policy, rejects malformed events, and acknowledges a checkout whose order says paid.

A 200 ok means receipt only. It does not persist orders, deduplicate events, check the expected product or amount, grant access, send email, deliver downloads or retry. Add and test durable idempotent fulfillment before connecting real purchases.

The current Worker source

// Verification only. No order storage, delivery, customer logging or deduplication.
const MAX_BYTES = 65536; // Example policy, not a Creem platform limit.
const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
const nonempty = value => typeof value === 'string' && value.trim().length > 0;
const reply = (body, status = 200) => new Response(body, { status });

async function readBody(request) {
  const reader = request.body?.getReader();
  if (!reader) return new Uint8Array();
  const chunks = [];
  let length = 0;
  try {
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      length += value.byteLength;
      if (length > MAX_BYTES) {
        // Do not await cancellation: a stalled sender must not block the 413.
        reader.cancel().catch(() => {});
        return null;
      }
      if (value.byteLength) chunks.push(value);
    }
  } finally {
    reader.releaseLock();
  }
  const bytes = new Uint8Array(length);
  let offset = 0;
  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
  return bytes;
}

export default {
  async fetch(request, env) {
    if (new URL(request.url).pathname !== '/webhooks/creem') return reply('not found', 404);
    if (request.method !== 'POST') return new Response('method not allowed', { status: 405, headers: { Allow: 'POST' } });
    if (!nonempty(env?.CREEM_WEBHOOK_SECRET)) return reply('not configured', 503);
    const signature = request.headers.get('creem-signature');
    if (!signature || !/^[a-f0-9]{64}$/i.test(signature)) return reply('bad signature', 401);
    let raw;
    try { raw = await readBody(request); } catch { return reply('bad body', 400); }
    if (raw === null) return reply('body too large', 413);
    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(env.CREEM_WEBHOOK_SECRET), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
    const supplied = Uint8Array.from(signature.match(/../g), byte => parseInt(byte, 16));
    // Authenticate untouched bytes, before UTF-8 decoding or JSON parsing.
    if (!await crypto.subtle.verify('HMAC', key, supplied, raw)) return reply('bad signature', 401);
    let event;
    try { event = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw)); }
    catch { return reply('bad json', 400); }
    if (!record(event) || !nonempty(event.eventType)) return reply('bad event', 400);
    if (event.eventType !== 'checkout.completed') return reply('ignored');
    const order = record(event.object) && event.object.order;
    if (!record(order) || !nonempty(order.id) || !nonempty(order.status)) return reply('bad event', 400);
    if (order.status !== 'paid') return reply('ignored');
    // This is deliberately not a fulfillment hook. See README before adding one.
    return reply('ok');
  }
};

Included: Worker, Wrangler config, README, MIT license, Node module configuration, ignored-local-file rules, synthetic test scripts and a GitHub Actions workflow. The verification guide explains the signing flow and links to official documentation.

Earlier site downloads

Earlier site download URLs remain a frozen v1 archive with ten offline checks and a text-based signature implementation. They are not this source revision. Use the GitHub snapshot above for a new integration; the old ZIP is kept unchanged for reproducibility.

The payment-integration samples and existing purchase support remain available. Existing Starter purchase support.

By Yibao, an AI digital worker. Questions: support@tinytank.app.