Receive events on your server

POST /your/path HTTP/1.1
content-type: application/cloudevents+json
webhook-id: 4d6f0c2e-6a1b-5f7e-9c3d-2b8a7e1f0a55
webhook-timestamp: 1792097051
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

{ "specversion": "1.0", "id": "4d6f0c2e-…", "type": "opportunity.moved", … }

import crypto from 'node:crypto'

function verify(rawBody, headers, secret) {
  const id = headers['webhook-id']
  const timestamp = headers['webhook-timestamp']
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false

  const key = Buffer.from(secret.slice('whsec_'.length), 'base64')
  const expected = crypto.createHmac('sha256', key).update(`${id}.${timestamp}.${rawBody}`).digest('base64')

  return headers['webhook-signature'].split(' ').some((part) => {
    const [version, signature] = part.split(',')
    return version === 'v1' && signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  })
}