Ed25519

Ed25519 is a digital signature scheme built on the elliptic curve Curve25519. It's fast, produces small 64-byte signatures and avoids many of the pitfalls of older schemes. It's used widely, from SSH keys to some blockchains.

Its advantage over HMAC is asymmetry: the signer keeps the private key and gives everyone the public key. Verifiers can check signatures but can't create them, so a leaked public key does no harm. There's no shared secret to store or rotate on your side.

On Valtu

Every webhook delivery carries X-Valtu-Signature-Ed25519, a signature over <timestamp>.<raw body> with your workspace's key. You verify it with the workspace's public key, which isn't secret. This is the recommended check:

import { constructEvent } from "@valtu/wallet-kit";
const event = constructEvent(rawBody, req.headers, { publicKey: process.env.VALTU_WEBHOOK_PUBLIC_KEY });

The Python SDK's construct_event does the same, and both also check the timestamp.