Local webhook CLI

Install the CLI as a development dependency when integrating webhooks:

pnpm add -D @dlbr/eid-cli

The CLI is intentionally separate from @dlbr/eid-sdk: the SDK stays portable across Node.js, Bun, Deno, and Cloudflare Workers, while the CLI is a Node.js tool for local development and CI fixtures.

Verify a fixture

Pass the exact raw request body from a file, stdin, or --body. The CLI uses the same signature verification and replay-protection implementation as the SDK:

eid webhook verify \
  --secret "$DLBR_ID_WEBHOOK_SECRET" \
  --file ./fixtures/webhook.json \
  --header 'webhook-signature=t=your_timestamp_here,v1=your_hex_signature_here'

Replace both placeholders with the timestamp and signature from the delivery.

Use --json for scripts and CI. Do not parse and re-serialize a signed body before passing it to the CLI.

Listen locally

Start a local endpoint and configure a staging webhook destination to point to it through your tunnel or proxy:

eid webhook listen \
  --secret "$DLBR_ID_WEBHOOK_SECRET" \
  --port 8787 \
  --path /webhooks

The listener returns 200 for a valid delivery and 400 for an invalid or replayed delivery. Replay claims are kept in memory for the process lifetime; use the SDK's distributed replay store in production.

For an automated smoke test, use --once --timeout-ms 10000 so the process exits after one valid delivery or fails when no delivery arrives.

Trigger a signed fixture

Use webhook trigger to exercise the listener with a real HMAC signature:

eid webhook trigger \
  --secret "$DLBR_ID_WEBHOOK_SECRET" \
  --url http://127.0.0.1:8787/webhooks \
  --event VERIFIED \
  --idempotency-key local-delivery-1

This is useful for local development and CI smoke tests because the body and signature are generated by the CLI using the same contract as the SDK.

Use the staging MCP server

The CLI can discover MCP tools, create a verification session, and read its status. Install the CLI as a development dependency:

pnpm add -D @dlbr/eid-cli
eid mcp tools

Tool discovery is public. Session commands need a staging Gateway API key with the corresponding scope. Supply it through the environment so it is not recorded as a command-line argument:

export MCP_API_KEY='your_staging_api_key_here'
eid mcp session create --format mso_mdoc
eid mcp session status --session-id session_id_here

The CLI defaults to https://mcp-staging.dlbr.app/mcp and blocks the production MCP hostname. Remote custom endpoints are restricted to the staging hostname; http://localhost is allowed for local development. Session creation uses the synthetic PID test request and defaults to a five-minute lifetime. Use only synthetic staging credentials for the demo. The CLI returns a wallet request URI and session ID; the status tool returns lifecycle information without credential claims or raw presentation tokens.

Use --json for machine-readable output, --issuer-id to select a different test issuer, and --ttl-ms to set a lifetime from one minute to 24 hours. The current Worker exposes session creation and status; token parsing and TSL checks are not available through MCP.