Hi all, Facing some issues trying to get webhook to work for Next.js (App Router) I've deployed to Vercel and facing this error.

⨯ Error: sha256 checksum of body does not match
    at tZ.receive (.next/server/chunks/3864.js:1:89506)
    at async u (.next/server/app/api/v1/app/stream/webhook/end/route.js:1:2321)

My code is as follows (snippet):

import { WebhookReceiver } from "livekit-server-sdk";
import { headers } from "next/headers";
import { NextRequest, NextResponse } from "next/server";

const LIVEKIT_API_KEY = process.env.LIVEKIT_API_KEY as string;
const LIVEKIT_API_SECRET = process.env.LIVEKIT_API_SECRET as string;
const receiver = new WebhookReceiver(LIVEKIT_API_KEY, LIVEKIT_API_SECRET);

export async function POST(request: NextRequest) {
  const headersList = await headers();
  const authorization = headersList.get("Authorization");

  const rawBody = await request.text();

  const event = await receiver.receive(rawBody, authorization);
  ...
}

Any help is appreciated! Thanks in advance!

The error message you're encountering, "sha256 checksum of body does not match," indicates that the webhook payload being received does not match the expected checksum. This is typically caused by one of the following issues: 1. Payload Modification: The payload may be altered during transmission. Ensure that the webhook URL is correctly configured and that no middleware or proxies are modifying the request body. 2. Authorization Header: The

Authorization

header must be correctly set and should match the expected format. Make sure that the token being sent in the header is valid and corresponds to the payload. 3. Body Parsing: Ensure that the raw body of the request is being read correctly. In your code snippet, you are using

await request.text()

to get the raw body, which is correct. However, if there are any issues with how the body is being sent from the LiveKit server, it could lead to a checksum mismatch. 4. Webhook Configuration: Double-check the webhook configuration on the LiveKit server to ensure that it is set up correctly to send the payload to your Next.js application. Here’s a relevant snippet from the

WebhookReceiver

class that handles the checksum verification:

async receive(
  body: string,
  authHeader?: string,
  skipAuth: boolean = false,
  clockTolerance?: string | number,
): Promise<WebhookEvent> {
  // verify token
  if (!skipAuth) {
    if (!authHeader) {
      throw new Error('authorization header is empty');
    }
    const claims = await this.verifier.verify(authHeader, clockTolerance);
    // confirm sha
    const hash = await digest(body);
    const hashDecoded = btoa(
      Array.from(new Uint8Array(hash))
        .map((v) => String.fromCharCode(v))
        .join(''),
    );

    if (claims.sha256 !== hashDecoded) {
      throw new Error('sha256 checksum of body does not match');
    }
  }
}

This function verifies the checksum of the body against the claims extracted from the authorization header. If they do not match, it throws the error you are seeing [webhook receiver] Recommendations: - The LiveKit server is sending the correct payload make sure the payload it is not being altered in transit. - Verify that the

Authorization

header is correctly formatted and contains the expected token. - If possible, log the raw body and the computed checksum on both the LiveKit server and your Next.js application to compare them. • it common for Vercel to require an extra query parameter like

x-vercel-protection-bypass

to by pass their anit-bot detection. By addressing these areas, you should be able to resolve the checksum mismatch issue. Notes: - The error is specifically related to the checksum verification process in the

WebhookReceiver

class. - Ensure that your environment variables for

LIVEKIT_API_KEY

and

LIVEKIT_API_SECRET

are correctly set in your Vercel deployment.

Thanks! I am using livekit cloud, so not much visibility at in livekit server. Logging attempts have failed to show up in vercel dashboard. Might need to tear all of it down and debug it one by one without passing through WebhookReceiver

I am expecting this is the issue. Check the Vercel docs: • it common for Vercel to require an extra query parameter like

x-vercel-protection-bypass

to by pass their anit-bot detection.

Gotcha thanks! Let me try that as soon as I can 🙂