Verify incoming event

Validate a signed Luma webhook with webhook.verify(), checking the HMAC signature header and returning a typed, unwrapped event payload.

Example

// In your HTTP handler
const event = webhook.verify({
  body: await req.text(),
  headers: req.headers,
});

Response

{
  "type": "guest.updated",
  "data": {
    "user_email": "[e-mail]",
    "event_tickets": [
      {
        "checked_in_at": "2024-06-01T12:00:00Z"
      }
    ]
  }
}

SDK webhook.verify(params: VerifyWebhookParams): UnwrappedWebhookEvent

Verifies the webhook signature and parses the event payload.

Example

// In your HTTP handler
const event = webhook.verify({
  body: await req.text(),
  headers: req.headers,
});

Response

{
  "type": "guest.updated",
  "data": {
    "user_email": "[e-mail]",
    "event_tickets": [
      {
        "checked_in_at": "2024-06-01T12:00:00Z"
      }
    ]
  }
}

Parameters

body · string | Uint8Array · required

Raw request body — do not re-serialize JSON.

headers · Headers | Record<string, string> · required

Request headers including webhook signature headers.

Handle an event

if (event.type === "guest.updated") {
  const checkedIn = event.data.event_tickets.some((t) => t.checked_in_at !== null);
  if (checkedIn) {
    // e.g. send welcome email to event.data.user_email
  }
}

Luma has no dedicated check-in webhook. Check-in arrives as guest.updated with event_tickets[].checked_in_at set. See the Guest Updated webhook docs.

Test it

1. Register an endpoint with luma.webhooks.create() and save the secret.
2. Trigger an event on a test calendar (for example, register a guest).
3. In your handler, call webhook.verify() and log event.type.

Verification errors throw WebhookSignatureError — see Error handling.