Document the validateWebhook interface on Node 18

Author: aron

README.md

@@ -264,6 +264,13 @@ const requestData = {
 const webhookIsValid = await validateWebhook(requestData);
 ```
 
+> [!NOTE]
+> The `validateWebhook` function uses the global `crypto` API available in most JavaScript runtimes. Node <= 18 does not provide this global so in this case you need to either call node with the `--no-experimental-global-webcrypto` or provide the `webcrypto` module manually.
+> ```js
+> const crypto = require("node:crypto").webcrypto;
+> const webhookIsValid = await valdiateWebhook(requestData, crypto);
+> ```
+
 ## TypeScript
 
 The `Replicate` constructor and all `replicate.*` methods are fully typed.

lib/util.js

@@ -53,6 +53,12 @@ async function validateWebhook(requestData, secretOrCrypto, customCrypto) {
       signature = requestData.headers["webhook-signature"];
     }
     body = requestData.body;
+    if (typeof secretOrCrypto !== "string") {
+      throw new Error(
+        "Unexpected value for secret passed to validateWebhook, expected a string"
+      );
+    }
+
     secret = secretOrCrypto;
     if (customCrypto) {
       crypto = customCrypto;