Webhooks

Node.js / Express

const crypto = require('crypto');
const express = require('express');

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const secret = process.env.WEBHOOK_SECRET;

  // Generate expected signature
  const expectedSig = 'sha256=' +
    crypto.createHmac('sha256', secret)
      .update(req.body)
      .digest('hex');

  // Verify signature
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSig)
  )) {
    return res.status(401).send('Invalid signature');
  }

  // Process webhook
  const payload = JSON.parse(req.body);
  console.log('Event:', payload.event);

  res.status(200).send('OK');
});

Python / Flask

import hmac
import hashlib
import os
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    secret = os.environ['WEBHOOK_SECRET']

    # Generate expected signature
    expected_sig = 'sha256=' + hmac.new(
        secret.encode(),
        request.data,
        hashlib.sha256
    ).hexdigest()

    # Verify signature
    if not hmac.compare_digest(signature, expected_sig):
        return 'Invalid signature', 401

    # Process webhook
    payload = request.json
    print(f"Event: {payload['event']}")

    return 'OK', 200

Go

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    signature := r.Header.Get("X-Webhook-Signature")
    secret := os.Getenv("WEBHOOK_SECRET")

    // Read body
    body, _ := io.ReadAll(r.Body)

    // Generate expected signature
    h := hmac.New(sha256.New, []byte(secret))
    h.Write(body)
    expectedSig := "sha256=" + hex.EncodeToString(h.Sum(nil))

    // Verify signature
    if !hmac.Equal([]byte(signature), []byte(expectedSig)) {
        http.Error(w, "Invalid signature", 401)
        return
    }

    // Process webhook
    var payload map[string]interface{}
    json.Unmarshal(body, &payload)
    fmt.Printf("Event: %s\n", payload["event"])

    w.WriteHeader(200)
}