Which headers are required for Svix verification?

Use `svix-id`, `svix-timestamp`, and `svix-signature` together with the raw request body and the endpoint signing secret.

Why must the raw body be preserved?

The signature covers the exact bytes sent. Parsing and then stringifying JSON can change whitespace or ordering, which produces a different HMAC.

How does Svix limit replay attacks?

Its signature includes a timestamp, and the official libraries reject messages whose timestamp is more than five minutes from the receiver's clock.

How can I stop Svix deliveries?

Disable or remove the endpoint in the sender's portal. A receiver can also return Svix's documented `webhook-delivery: disable` response header when it intends to disable the endpoint.

Does Svix traffic affect AI search or model training?

No. Svix delivers product events to registered endpoints. It does not crawl the destination or use its pages as AI input.

svix: What It Is & How to Handle It

What is svix?

Svix provides webhook delivery infrastructure for software products. A product creates an application for a customer, registers one or more endpoints, and sends messages through Svix. Each matching endpoint receives the message, so the business named in the payload may be the product using Svix rather than Svix itself.

A delivery includes svix-id, svix-timestamp, and svix-signature. The endpoint has its own signing secret, usually beginning with whsec_, and the signature covers the message identifier, timestamp, and raw payload. Svix's libraries verify these values together and reject timestamps outside their five-minute tolerance.

Svix retries failed messages with exponential backoff. The same svix-id can therefore appear in more than one attempt and should be used for duplicate protection. Endpoints can be disabled manually, by a delivery-control response, or after the documented period of sustained failures unless that automatic behavior is turned off.

This is outbound application messaging, not web crawling. Svix does not inspect the destination's public pages for AI search and does not train models from the callback. Robots.txt is irrelevant to an endpoint created for webhook delivery.

Not relevant for AI search

Is svix relevant for AI search?

No. svix is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

svix is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle svix

For a live endpoint, retrieve its signing secret from the product's webhook portal and use a Svix verification library. Pass the untouched request body and all three svix-* headers to the verifier before parsing or acting on the payload. Keep the server clock synchronized because timestamp validation is part of replay protection.

Record svix-id and make side effects idempotent. Return a successful response after the verified message has been accepted; return an error for a bad signature or a failure that should be retried. Re-serializing parsed JSON before verification will change the signed bytes and cause a valid request to fail.

If delivery should end, disable or delete the endpoint through the sending product. Svix also documents webhook-delivery: disable for a receiver that intentionally wants to stop future messages. A robots rule or lowercase svix user-agent match is not an authentication or delivery control.

Examples

An identity provider uses Svix to notify a customer's endpoint that a user account was created.
A framework parses JSON too early, so the receiver switches to the raw body and the `svix-signature` check begins to pass.
A failed first attempt is retried with the same `svix-id`, and the handler finds the message in its deduplication table.

Frequently asked questions about svix

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

Software companies can use Svix as their delivery layer. The event belongs to that product, while Svix signs and transports it to the registered endpoint.