Webhooks & Event Lifecycle

All webhook requests include three Svix verification headers:

• svix-id: Unique message ID.
• svix-timestamp: Timestamp of delivery.
• svix-signature: Cryptographic HMAC-SHA256 signature.

Use the official svix library in Node.js to verify payloads before processing:

import { Webhook } from 'svix';

const wh = new Webhook(process.env.WEBHOOK_SECRET!);
try {
  const payload = wh.verify(rawBody, {
    'svix-id': req.headers['svix-id'],
    'svix-timestamp': req.headers['svix-timestamp'],
    'svix-signature': req.headers['svix-signature'],
  });
  console.log('Verified webhook event:', payload);
} catch (err) {
  res.status(401).send('Invalid webhook signature');
}

• project.published: Triggered when a team member publishes a template to production.
• template.exported: Emitted when a batch HTML export completes.
• workspace.member_added: Emitted when permissions are updated.