Cloudflare Worker for a social video pipeline: SDK verifyWebhook

@sume-com/sdk 0.2.0 has no runtime dependencies and needs only fetch and WebCrypto, so it runs on Node 18+, Bun, Deno and Cloudflare Workers. Its verifyWebhook is async, takes the raw body, headers and secret, and returns false instead of throwing, which fits a small Worker that receives a Sume webhook and starts a social post.

Read the secret from the dashboard Webhooks tab or GET /v1/webhooks/signing-secret with an account:read key, and store it as SUME_COM_WEBHOOK_SIGNING_SECRET.

What does the helper need?

From Sume's SDK docs.

What does the Worker look like?

Read the body as text before any JSON parse, refuse a missing secret, and return a fast 2xx.

import { verifyWebhook } from "@sume-com/sdk";

export default {
  async fetch(request: Request, env: { SUME_COM_WEBHOOK_SIGNING_SECRET?: string }) {
    const secret = env.SUME_COM_WEBHOOK_SIGNING_SECRET;
    if (!secret) return new Response("not configured", { status: 500 });
    const body = await request.text();
    const ok = await verifyWebhook({ body, headers: request.headers, secret });
    if (!ok) return new Response("bad signature", { status: 401 });
    const event = JSON.parse(body);
    if (event.event === "job.completed") {
      // enqueue the platform posts here, keyed by event.job_id
    }
    return new Response(null, { status: 204 });
  },
};

What should happen after the 2xx?

Do the platform posts from a queue, not inside the request: Sume allows 10 seconds for each attempt, and a slow endpoint spends that budget and is retried. Dedupe on job_id, since a delivery can arrive more than once.