Webhooks

{
  "id": "evt_01J9…",
  "type": "lead.captured",
  "created_at": "2026-09-22T10:00:00Z",
  "api_version": "v1",
  "workspace": "wsp_…",
  "agent": "agt_…",
  "data": { "object": { "id": "con_…", "object": "contact", "email": "jane@example.com", "name": "Jane" } }
}

webhook-id: evt_01J9…                        (the same on every retry of this event)
webhook-timestamp: 1790000000                 (Unix seconds)
webhook-signature: v1,K5oZfz…=               (can hold several, space-separated, during secret rotation)

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyOnetypeSignature(rawBody, headers, secret, toleranceSeconds = 300)
{
    const id = headers["webhook-id"];
    const timestamp = headers["webhook-timestamp"];
    const signatures = headers["webhook-signature"];
    if (!id || !timestamp || !signatures)
    {
        throw new Error("missing webhook headers");
    }
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds)
    {
        throw new Error("timestamp outside tolerance");
    }

    const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
    const expected = createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest();

    for (const entry of signatures.split(" "))
    {
        const [version, value] = entry.split(",");
        const candidate = Buffer.from(value ?? "", "base64");
        if (version === "v1" && candidate.length === expected.length && timingSafeEqual(candidate, expected))
        {
            return JSON.parse(rawBody);
        }
    }
    throw new Error("no matching signature");
}

// Express: keep the raw body for this route
app.post("/hooks/onetype", express.raw({ type: "application/json" }), (req, res) => {
    let event;
    try { event = verifyOnetypeSignature(req.body.toString("utf8"), req.headers, process.env.ONETYPE_WEBHOOK_SECRET); }
    catch { return res.sendStatus(400); }
    if (event.type === "lead.captured") crm.upsert(event.data.object);
    res.sendStatus(204);
});

import base64, hashlib, hmac, json, time

def verify_onetype_signature(raw_body: bytes, headers, secret: str, tolerance_seconds: int = 300):
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signatures = headers.get("webhook-signature")
    if not msg_id or not timestamp or not signatures:
        raise ValueError("missing webhook headers")
    if abs(time.time() - int(timestamp)) > tolerance_seconds:
        raise ValueError("timestamp outside tolerance")

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()

    for entry in signatures.split(" "):
        version, _, value = entry.partition(",")
        if version == "v1" and hmac.compare_digest(value, expected):
            return json.loads(raw_body)
    raise ValueError("no matching signature")

# Flask: request.get_data() is the raw body; request.headers is case-insensitive

<?php
function verifyOnetypeSignature(string $rawBody, array $headers, string $secret, int $toleranceSeconds = 300): array
{
    $id = $headers['webhook-id'] ?? null;
    $timestamp = $headers['webhook-timestamp'] ?? null;
    $signatures = $headers['webhook-signature'] ?? null;
    if (!$id || !$timestamp || !$signatures) {
        throw new RuntimeException('missing webhook headers');
    }
    if (abs(time() - (int) $timestamp) > $toleranceSeconds) {
        throw new RuntimeException('timestamp outside tolerance');
    }

    $key = base64_decode(preg_replace('/^whsec_/', '', $secret), true);
    $expected = base64_encode(hash_hmac('sha256', "{$id}.{$timestamp}.{$rawBody}", $key, true));

    foreach (explode(' ', $signatures) as $entry) {
        [$version, $value] = array_pad(explode(',', $entry, 2), 2, '');
        if ($version === 'v1' && hash_equals($expected, $value)) {
            return json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
        }
    }
    throw new RuntimeException('no matching signature');
}

// Usage: $raw = file_get_contents('php://input');
// $headers = array_change_key_case(getallheaders(), CASE_LOWER);