When receiving a message from QStash, you should verify the signature. The QStash Typescript SDK provides a helper function for this.

import { Receiver } from "@upstash/qstash";



const receiver = new Receiver({

  currentSigningKey: "YOUR_CURRENT_SIGNING_KEY",

  nextSigningKey: "YOUR_NEXT_SIGNING_KEY",

});



// ... in your request handler



const signature = req.headers["Upstash-Signature"];

const body = req.body;



const isValid = receiver.verify({

  body,

  signature,

  url: "YOUR-SITE-URL",

});