@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Asymmetric webhook sources can now verify ECDSA P-384 signatures (`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256 digest of the signing string (`prehash: "sha256"`). ECDSA signatures are accepted in DER or raw `r||s` form.
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+Hosted webhook endpoints can verify ECDSA P-384 (SHA-384) signatures, ECDSA signatures in raw `r||s` form, and RSA signatures made over a SHA-256 digest of the signing string (`prehash: "sha256"`).
@@ -242,7 +242,7 @@ Custom sources support these schemes:
 | `hmac` | Computes an HMAC over the raw body or a signing template and compares it with a request header. |
 | `shared-secret` | Compares a static token supplied in a header, bearer token, basic authentication, or request body. |
 | `url-secret` | Compares a token in a URL query parameter. Hosted endpoints don't support path placement. |
-| `asymmetric` | Verifies an Ed25519, ECDSA, or RSA signature using the provider's public key. |
+| `asymmetric` | Verifies an Ed25519, ECDSA (P-256 with SHA-256, P-384 with SHA-384), or RSA-SHA256 signature using the provider's public key. Set `prehash: "sha256"` when the provider signs a SHA-256 digest of the signing string instead of the string itself. |
 
 <Warning>
   Query parameters can appear in access logs, proxies, and traces. Prefer a header-based scheme when
 
@@ -1,5 +1,5 @@
 import type { WebhookAsymmetricConfig as AsymmetricConfig } from "@trigger.dev/core/v3";
-import { createPublicKey, verify as cryptoVerify, type KeyObject } from "node:crypto";
+import { createHash, createPublicKey, verify as cryptoVerify, type KeyObject } from "node:crypto";
 import { deriveIdempotencyKey, parseEventBody } from "./derive.js";
 import { prepareSignedVerification } from "./parse.js";
 import type { SchemeVerifier, VerifierResult, VerifyInput } from "./types.js";
@@ -9,6 +9,17 @@ import { decodeSignature } from "./util.js";
 // Lets us accept a raw Ed25519 key (e.g. Discord's hex public key) without a PEM wrapper.
 const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 
+// Ed25519 is PureEdDSA (no prehash) → algorithm null; the others name the digest Node signs with.
+const NODE_ALGORITHM: Record<AsymmetricConfig["algorithm"], string | null> = {
+  ed25519: null,
+  "ecdsa-p256": "sha256",
+  "ecdsa-p384": "sha384",
+  "rsa-sha256": "sha256",
+};
+
+// ECDSA signatures arrive either DER-encoded or as raw r||s (IEEE P1363); accept both.
+const DSA_ENCODINGS = ["der", "ieee-p1363"] as const;
+
 function importPublicKey(
   stored: string,
   encoding: AsymmetricConfig["publicKeyEncoding"],
@@ -46,20 +57,22 @@ export const asymmetricVerifier: SchemeVerifier = {
       return fail("invalid public key", cfg, input);
     }
 
-    // Ed25519 is PureEdDSA (no prehash) → algorithm null; ECDSA/RSA hash with sha256.
-    const nodeAlgorithm = cfg.algorithm === "ed25519" ? null : "sha256";
+    const nodeAlgorithm = NODE_ALGORITHM[cfg.algorithm];
+    const message = cfg.prehash
+      ? createHash(cfg.prehash).update(prep.signingBytes).digest()
+      : prep.signingBytes;
+    const isEcdsa = cfg.algorithm === "ecdsa-p256" || cfg.algorithm === "ecdsa-p384";
+    const keys = isEcdsa ? DSA_ENCODINGS.map((dsaEncoding) => ({ key, dsaEncoding })) : [key];
 
     const matched = prep.signatures.some((sig) => {
-      try {
-        return cryptoVerify(
-          nodeAlgorithm,
-          prep.signingBytes,
-          key,
-          decodeSignature(sig, cfg.encoding)
-        );
-      } catch {
-        return false;
-      }
+      const signature = decodeSignature(sig, cfg.encoding);
+      return keys.some((k) => {
+        try {
+          return cryptoVerify(nodeAlgorithm, message, k, signature);
+        } catch {
+          return false;
+        }
+      });
     });
     if (!matched) return fail("signature mismatch", cfg, input);
 
 
@@ -1,4 +1,10 @@
-import { createHmac, generateKeyPairSync, sign as cryptoSign, type KeyObject } from "node:crypto";
+import {
+  createHash,
+  createHmac,
+  generateKeyPairSync,
+  sign as cryptoSign,
+  type KeyObject,
+} from "node:crypto";
 import { WebhookVerifierConfig } from "@trigger.dev/core/v3";
 import { webhookProviderConfigs } from "@trigger.dev/core/webhooks";
 import { describe, expect, it } from "vitest";
@@ -471,6 +477,77 @@ describe("asymmetric verifier (config-driven)", () => {
     );
     expect(result.ok).toBe(true);
   });
+
+  it("verifies a Bridge-style RSA signature over a SHA-256 digest with prehash", () => {
+    const { publicKey, privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+    const pem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    const ts = String(NOW_MS);
+    const body = JSON.stringify({ event_type: "customer.updated" });
+    const digest = createHash("sha256").update(`${ts}.${body}`).digest();
+    const sig = cryptoSign("sha256", digest, privateKey).toString("base64");
+    const config = {
+      scheme: "asymmetric",
+      algorithm: "rsa-sha256",
+      encoding: "base64",
+      signatureHeader: "x-webhook-signature",
+      signature: { itemSeparator: ",", fieldSeparator: "=", field: "v0" },
+      timestamp: {
+        source: { from: "signatureField", field: "t" },
+        unit: "milliseconds",
+        toleranceSeconds: 600,
+      },
+      signingString: { template: "{timestamp}.{body}" },
+      prehash: "sha256",
+    };
+    const request = (cfgOverrides: Record<string, unknown>, rawBody: string) =>
+      verify(
+        cfg({ ...config, ...cfgOverrides }),
+        input({
+          rawBytes: bytes(rawBody),
+          secret: pem,
+          headers: { "x-webhook-signature": `t=${ts},v0=${sig}` },
+        })
+      );
+
+    expect(request({}, body).ok).toBe(true);
+    expect(request({ prehash: undefined }, body).ok).toBe(false);
+    expect(request({}, '{"event_type":"customer.deleted"}').ok).toBe(false);
+  });
+
+  it("verifies an ECDSA P-384 / SHA-384 signature in DER and raw r||s form", () => {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-384" });
+    const pem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    const body = JSON.stringify({ id: "evt_1" });
+    const config = cfg({
+      scheme: "asymmetric",
+      algorithm: "ecdsa-p384",
+      encoding: "base64",
+      signatureHeader: "webhook-signature",
+      signature: {},
+      signingString: "raw",
+    });
+    const withSig = (sig: Buffer, rawBody = body) =>
+      verify(
+        config,
+        input({
+          rawBytes: bytes(rawBody),
+          secret: pem,
+          headers: { "webhook-signature": sig.toString("base64") },
+        })
+      );
+
+    const der = cryptoSign("sha384", Buffer.from(body), privateKey);
+    const p1363 = cryptoSign("sha384", Buffer.from(body), {
+      key: privateKey,
+      dsaEncoding: "ieee-p1363",
+    });
+    expect(withSig(der).ok).toBe(true);
+    expect(withSig(p1363).ok).toBe(true);
+    expect(withSig(der, '{"id":"evt_2"}').ok).toBe(false);
+
+    const sha256Sig = cryptoSign("sha256", Buffer.from(body), privateKey);
+    expect(withSig(sha256Sig).ok).toBe(false);
+  });
 });
 
 describe("adversarial / fail-closed", () => {
 
@@ -167,17 +167,23 @@ export type WebhookHmacConfig = z.infer<typeof WebhookHmacConfig>;
 
 // Asymmetric (public-key) signatures: the provider signs with a private key, we verify with
 // their public key. Same parsing/template primitives as HMAC; only the final verify differs.
-// Covers Discord (ed25519), SendGrid (ecdsa-p256), RSA providers. Dynamic key fetch (PayPal
-// cert URL / JWKS) is out of scope → the custom-bundle escape hatch.
+// Covers Discord (ed25519), SendGrid (ecdsa-p256), ecdsa-p384 (SHA-384), RSA providers. Dynamic
+// key fetch (PayPal cert URL / JWKS) is out of scope → the custom-bundle escape hatch.
 export const WebhookAsymmetricConfig = z
   .object({
     scheme: z.literal("asymmetric"),
-    algorithm: z.enum(["ed25519", "ecdsa-p256", "rsa-sha256"]),
+    algorithm: z.enum(["ed25519", "ecdsa-p256", "ecdsa-p384", "rsa-sha256"]),
     encoding: z.enum(["hex", "base64"]), // how the signature value is encoded
     signatureHeader: z.string(),
     signature: WebhookSignatureExtraction.optional(),
     timestamp: WebhookTimestampConfig.optional(),
     signingString: WebhookSigningString,
+    /**
+     * Hash the signing string first and verify the signature over that raw digest, for providers
+     * that sign a digest rather than the payload (Bridge signs `sha256("{timestamp}.{body}")` with
+     * RSA-SHA256, so the payload is hashed twice). Omit to verify over the signing string itself.
+     */
+    prehash: z.enum(["sha256"]).optional(),
     // How the stored public key is encoded: a PEM string, base64 of DER SPKI (SendGrid),
     // or raw key bytes (ed25519 raw, Discord). Defaults to "pem".
     publicKeyEncoding: z.enum(["pem", "spki-der-base64", "raw-hex", "raw-base64"]).optional(),
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"@trigger.dev/core": patch
 +---
++
 +Asymmetric webhook sources can now verify ECDSA P-384 signatures (`algorithm: "ecdsa-p384"`, SHA-384) and providers that sign a SHA-256 digest of the signing string (`prehash: "sha256"`). ECDSA signatures are accepted in DER or raw `r||s` form.