Webhooks

{
  "event": "otp.status_update",
  "meta_message_id": "wamid.HBgLMjAxMjM0NTY3ODkVAgARGBI...",
  "status": "delivered"
}

{
  "event": "account.low_balance",
  "balance": 1.42
}

import { createHmac, timingSafeEqual } from 'node:crypto';

function isValidWebhook(rawBody, signatureHeader, webhookSecret) {
  const expected = createHmac('sha256', webhookSecret).update(rawBody).digest('hex');
  const provided = (signatureHeader || '').replace('sha256=', '');
  const a = Buffer.from(expected);
  const b = Buffer.from(provided);
  return a.length === b.length && timingSafeEqual(a, b);
}

// rawBody must be the exact, unparsed request body — verify BEFORE JSON.parse.
app.post('/webhooks/authevo', (req, res) => {
  const signature = req.headers['x-authevo-signature'];
  if (!isValidWebhook(req.rawBody, signature, process.env.AUTHEVO_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.rawBody);
  // handle event.event === 'otp.status_update'
  res.status(200).end();
});