# JavaScript / TypeScript webhook signing

```javascript
import { createHmac } from "node:crypto";

export function sign(rawBody, secret) {
  return createHmac("sha256", Buffer.from(secret, "utf8"))
    .update(rawBody) // Buffer containing the exact bytes sent
    .digest("hex");
}
```

Set `X-Platform-Signature` to the lowercase result. Do not parse and reserialize after signing. Test vector: secret `test-secret`, body `{"status":"delivered"}`, signature `bfebae765b7f20464b4b64d37314fc073a178a293762aaf32920be724d5fde18`.