Verify a Sume avatar video webhook in Deno with crypto.subtle.verify

The short answer

Import the secret as an HMAC key with the verify usage, decode each sume-v1= hex entry to bytes, and call crypto.subtle.verify("HMAC", key, signature, data) on <timestamp>.<raw body>. MDN (read 2026-10-04) describes verify() as the method that verifies a digital signature, so you never compare strings yourself.

The Deno verifier

Run it with deno run --allow-net --allow-env server.ts and set the secret in the environment. A missing variable becomes an empty string, and the function returns false for every request, which is the right failure mode.

const secret = Deno.env.get("SUME_COM_WEBHOOK_SIGNING_SECRET") ?? "";
const enc = new TextEncoder();
const bytes = (h: string) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));

async function verify(body: string, ts: string, header: string) {
  if (!secret || !/^\d+$/.test(ts)) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = await crypto.subtle.importKey(
    "raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
  let ok = false;
  for (const entry of header.split(",")) {
    const e = entry.trim();
    if (!e.startsWith("sume-v1=") || !/^[0-9a-f]{64}$/.test(e.slice(8))) continue;
    if (await crypto.subtle.verify("HMAC", key, bytes(e.slice(8)), enc.encode(`${ts}.${body}`))) {
      ok = true;
    }
  }
  return ok;
}

Deno.serve(async (req) => {
  const body = await req.text();
  const good = await verify(
    body,
    req.headers.get("x-sume-webhook-timestamp") ?? "",
    req.headers.get("x-sume-webhook-signature") ?? "",
  );
  return new Response(good ? "ok" : "bad signature", { status: good ? 200 : 401 });
});

What Sume sends

Sume signs the raw JSON body of every terminal job event. An avatar talking video submitted with mode: "webhook" and a public HTTPS webhook_url ends in one of three events, and your endpoint must verify the signature before it trusts the payload. The contract from the webhook docs:

Why this Deno code is shaped this way

The code checks that each entry is 64 lowercase hex characters before decoding, so a malformed header entry is skipped instead of throwing. Using verify avoids hand-written comparison code, which is the usual place where timing mistakes creep in.

Operating it

Verify against the raw bytes you received, never a parsed and re-serialized object, because any change in spacing breaks the HMAC. Return a 2xx only after you have stored the event durably, and use job_id as the idempotency key, since a delivery can arrive more than once. If your endpoint was down, POST /v1/jobs/{job_id}/webhook/redeliver (scope jobs:write) re-sends the real terminal event with a fresh timestamp and signature, and POST /v1/webhooks/test-deliveries sends a signed dummy webhook.test payload to try your route first. Keep polling the job status as a fallback, because ten refused attempts end automatic delivery.

The code refuses an empty secret and a stale or non-numeric timestamp, checks every sume-v1= entry in the header so a rotation never rejects a good delivery, and does not stop at the first match. A Standard avatar clip costs $0.184 per second, so a rejected webhook is not a rejected video: the render is already paid for and fetchable from the job result. For the same check in other languages, see the Node and Python versions, and the queue limits by plan if you submit many clips at once.