Test Sonatype Nexus Repository webhooks locally

Receive Nexus Repository events on your laptop while you build, with a URL Nexus can reach.

Horizon has no Nexus integration. Nexus sends webhooks to a URL, and Horizon provides a public one. Your Nexus server must be able to reach that URL.

Before you beginCopy Anchor Link

• Node.js 18 or later
• A Horizon account and the CLI (see Getting started)
• A reserved subdomain for -s. Reserve one on the Subdomains page.
• A Next.js app that uses the App Router and runs on port 3000
• A Nexus Repository instance where you are an administrator with permission to create capabilities

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const secret = process.env.NEXUS_WEBHOOK_SECRET;
  if (!secret) {
    return new Response("Missing NEXUS_WEBHOOK_SECRET", { status: 500 });
  }

  const body = await request.json();
  const received = request.headers.get("x-nexus-webhook-signature") ?? "";
  const expected = createHmac("sha1", secret)
    .update(JSON.stringify(body))
    .digest("hex");

  const receivedBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  const isValid =
    receivedBuffer.length === expectedBuffer.length &&
    timingSafeEqual(receivedBuffer, expectedBuffer);

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  const eventType = request.headers.get("x-nexus-webhook-id");
  console.log(`Received Nexus event: ${eventType} ${body.action}`);

  return new Response("ok", { status: 200 });
}

NEXUS_WEBHOOK_SECRET=replace-with-a-long-random-string

npm run dev

hrzn tunnel http://localhost:3000 -s my-nexus-app

HORIZON: Tunnel connected
  URL          https://my-nexus-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-nexus-app

Check it worksCopy Anchor Link

In the terminal that runs hrzn, you see one line for the delivery:

  POST    200  /api/webhooks/nexus

Your app terminal prints a line such as:

Received Nexus event: rm:repository:asset CREATED

X-Nexus-Webhook-Id holds the event type, for example rm:repository:asset. X-Nexus-Webhook-Delivery is a unique UUID for the event.

If the line shows [401], see Troubleshooting.

TroubleshootingCopy Anchor Link

The signature doesn't matchCopy Anchor Link

• Check that NEXUS_WEBHOOK_SECRET is identical to the Secret Key in Nexus, with no extra spaces or newline.
• Nexus hashes the JSON body without whitespace. The handler stringifies the parsed body to match. If you hash the raw text and it differs, return to the stringified body.
• The algorithm is SHA-1, not SHA-256.
• Restart npm run dev after you edit .env.local.

Audit events never arriveCopy Anchor Link

If you select the audit event type on a global webhook, you must also enable the separate Audit capability.

The URL changed after a restartCopy Anchor Link

You started the tunnel without -s, so Horizon gave you a new random subdomain. Restart with -s my-nexus-app and the URL stays the same. -s needs a subdomain you reserved, see Pricing.

Nothing reaches your appCopy Anchor Link

• Check that the Horizon terminal is still running. If its last line is Connection lost. Reconnecting…, wait for Reconnected.
• Check that URL ends with /api/webhooks/nexus.
• Check that the Nexus server can reach the internet to call your hrzn.run URL.

Next stepsCopy Anchor Link

• Read Sonatype's guide to working with HMAC payloads.
• See the example headers and payloads.