Test Clerk Webhooks Locally

// Clerk's own scheme, by hand, so the verification is explicit.
// In production prefer verifyWebhook() from @clerk/nextjs/webhooks (or the svix
// lib) — it does the base64 secret decode, the v1, prefix strip and the
// 5-minute timestamp check for you.
import crypto from 'crypto'

function verifyClerkWebhook(rawBody, headers, signingSecret) {
  const svixId = headers['svix-id']
  const svixTimestamp = headers['svix-timestamp']
  const svixSignature = headers['svix-signature']
  if (!svixId || !svixTimestamp || !svixSignature) {
    throw new Error('missing one of svix-id / svix-timestamp / svix-signature')
  }

  // 5-minute replay window (Svix default): reject stale or future timestamps.
  const now = Math.floor(Date.now() / 1000)
  const sent = parseInt(svixTimestamp, 10)
  if (Math.abs(now - sent) > 60 * 5) {
    throw new Error('svix-timestamp outside the 5-minute tolerance')
  }

  // whsec_ secret is base64 AFTER the prefix — decode it to raw key bytes.
  const key = Buffer.from(signingSecret.replace(/^whsec_/, ''), 'base64')

  // Sign "{svix-id}.{svix-timestamp}.{raw body}" — raw body, never re-stringified.
  const signedContent = svixId + '.' + svixTimestamp + '.' + rawBody
  const expected = crypto.createHmac('sha256', key).update(signedContent).digest('base64')

  // svix-signature is a space-delimited list of "v1,<base64sig>" (key rotation).
  // Strip the "v1," version prefix and match at least one in constant time.
  const ok = svixSignature.split(' ').some((entry) => {
    const sig = entry.split(',')[1]
    if (!sig || sig.length !== expected.length) return false
    return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
  })
  if (!ok) throw new Error('no v1 signature matched the expected HMAC')
  return JSON.parse(rawBody)
}

// Next.js App Router: read the RAW body, never the parsed JSON.
export async function POST(req) {
  const rawBody = await req.text()
  const headers = Object.fromEntries(req.headers)
  try {
    const evt = verifyClerkWebhook(rawBody, headers, process.env.CLERK_WEBHOOK_SIGNING_SECRET)
    if (evt.type === 'user.created') {
      // mirror the user into your DB
    }
    return new Response('ok', { status: 200 })
  } catch (err) {
    return new Response('Webhook Error: ' + err.message, { status: 400 })
  }
}