Webhooks

{
  "messageId": "string — the unique identifier of the event notification",
  "event": "string — the webhook event being delivered",
  "apiTrackingCode": "string | null — an identifier for tracking a case",
  "apiTrackingUser": "string | null — an identifier for tracking a case",
  "eventObject": "object — various properties with information related to the event"
}

POST /webhook-endpoint HTTP/1.1
host: example.com
content-length: 1902
user-agent: Svix-Webhooks/1.84.0 
content-type: application/json
accept: */*
webhook-id: msg_3ErCD0YuVlJPXMDLSUg3PpMJGN5
webhook-timestamp: 1780927177
webhook-signature: v1,IMc336RAKV7xItISRHppXKlcGlyPW2kC1xwG/jOPB4g=

{
  "messageId": "72fcd5f8-fb13-7de2-2152-e88e5257aff4",
  "event": "case.statuschange",
  "apiTrackingCode": null,
  "apiTrackingUser": null,
  "eventObject": {
    ...
  }
}

import crypto from "crypto";

const secret = process.env.KARMACHECK_WEBHOOK_SECRET!; // "whsec_..."
const TOLERANCE_SECONDS = 5 * 60;

function verify(webhookId: string, webhookTimestamp: string, webhookSignature: string, rawBody: string): boolean {
  if (Math.abs(Date.now() / 1000 - Number(webhookTimestamp)) > TOLERANCE_SECONDS) return false;

  const secretBytes = Buffer.from(secret.split("_")[1], "base64");
  const expected = crypto
    .createHmac("sha256", secretBytes)
    .update(`${webhookId}.${webhookTimestamp}.${rawBody}`)
    .digest();

  return webhookSignature.split(" ").some((sig) => {
    const received = Buffer.from(sig.split(",")[1] ?? "", "base64");
    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });
}