Fix webhook verification

Author: LarsenCundric

.fern/metadata.json

@@ -16,15 +16,15 @@
             }
         },
         "extraDependencies": {
-            "fast-json-stable-stringify": "^2.1.0"
+            "fast-json-stable-stringify": "^2.1.0",
+            "zod": "^4"
         },
         "extraDevDependencies": {
             "@dotenvx/dotenvx": "^1.49.0",
             "react": "^19.1.1",
             "react-dom": "^19.1.1",
             "tsconfig-paths": "^4.2.0",
-            "ts-node": "^10.5.0",
-            "zod": "^4"
+            "ts-node": "^10.5.0"
         },
         "extraPeerDependencies": {
             "react": "^18 || ^19",

package.json

@@ -44,7 +44,8 @@
         "tsn": "ts-node -r tsconfig-paths/register"
     },
     "dependencies": {
-        "fast-json-stable-stringify": "^2.1.0"
+        "fast-json-stable-stringify": "^2.1.0",
+        "zod": "^4"
     },
     "peerDependencies": {
         "react": "^18 || ^19",
@@ -62,8 +63,7 @@
         "react": "^19.1.1",
         "react-dom": "^19.1.1",
         "tsconfig-paths": "^4.2.0",
-        "ts-node": "^10.5.0",
-        "zod": "^4"
+        "ts-node": "^10.5.0"
     },
     "browser": {
         "fs": false,

src/wrapper/lib/webhooks.ts

@@ -81,7 +81,7 @@ export async function verifyWebhookEventSignature(
         }
 
         const signature = createWebhookSignature({
-            payload: event.data.payload,
+            body: event.data, // NOTE: We need to encrypt the entire body, not just the payload
             timestamp: evt.timestamp,
             secret: cfg.secret,
         });
@@ -102,15 +102,15 @@ export async function verifyWebhookEventSignature(
  * Creates a webhook signature for the given payload, timestamp, and secret.
  */
 export function createWebhookSignature({
-    payload,
+    body,
     timestamp,
     secret,
 }: {
-    payload: unknown;
+    body: unknown;
     timestamp: string;
     secret: string;
 }): string {
-    const dump = stringify(payload);
+    const dump = stringify(body);
     const message = `${timestamp}.${dump}`;
 
     const hmac = createHmac("sha256", secret);