Webhook examples

import express from "express";
import crypto from "crypto";

const app = express();
const SECRET = process.env.POCKETSFLOW_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60;

app.post(
  "/webhooks/pocketsflow",
  express.raw({ type: "application/json" }), // keep the raw Buffer
  async (req, res) => {
    const signature = req.get("X-Pocketsflow-Signature-V2") || "";
    const eventId = req.get("X-Pocketsflow-Event-Id") || "";
    const eventType = req.get("X-Pocketsflow-Event") || "";
    const rawBody = req.body; // Buffer

    if (!verify(rawBody, signature, SECRET)) {
      return res.status(400).send("Invalid signature");
    }

    // Retries and redeliveries reuse the event id — acknowledge and skip.
    if (await alreadyReceived(eventId)) {
      return res.status(200).send("Duplicate");
    }

    // Acknowledge first, then process asynchronously.
    res.status(200).send("OK");

    const event = JSON.parse(rawBody.toString("utf8"));
    queue.push({ eventId, eventType, event }); // hand off to a background worker
  }
);

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((part) => part.split("=", 2))
  );
  const timestamp = Number(parts.t);
  if (!Number.isInteger(timestamp) || !parts.v1) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > TOLERANCE_SECONDS) {
    return false;
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest("hex");
  const a = Buffer.from(parts.v1, "utf8");
  const b = Buffer.from(expected, "utf8");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Worker (illustrative) — idempotent routing by event type.
function handle({ eventType, event }) {
  switch (eventType) {
    case "order.completed":
      if (seen(event.order.id)) return;
      grantAccess(event.customer.email, event.product.id);
      markSeen(event.order.id);
      break;
    case "customer.subscription.created": // new subscriber — fires once, on activation
      provisionMembership(event.subscription.id, event.customer.email);
      break;
    case "invoice.payment_succeeded": // renewal
      if (seen(event.paymentId)) return;
      extendMembership(event.subscription.customerId);
      markSeen(event.paymentId);
      break;
    case "invoice.upcoming": // renewal is 3 days out — optional heads-up
      remindUpcomingCharge(event.subscription.customerId, event.renewalAt);
      break;
    case "invoice.payment_failed":
      startDunning(event.subscription.customerId, event.failureMessage);
      break;
    case "customer.subscription.pause": // billing stopped, access retained
      keepAccessNoBilling(event.subscription.customerId);
      break;
    case "customer.subscription.resumed": // billing restarted
      extendMembership(event.subscription.customerId);
      break;
    case "customer.subscription.deleted":
      revokeAccess(event.subscription.customerId);
      break;
    default:
      // Ignore events you don't handle.
      break;
  }
}

import crypto from "crypto";

const TOLERANCE_SECONDS = 5 * 60;

export async function POST(req: Request) {
  const raw = Buffer.from(await req.arrayBuffer());
  const header = req.headers.get("x-pocketsflow-signature-v2") ?? "";
  const eventId = req.headers.get("x-pocketsflow-event-id") ?? "";
  const eventType = req.headers.get("x-pocketsflow-event") ?? "";
  const secret = process.env.POCKETSFLOW_WEBHOOK_SECRET!;

  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const timestamp = Number(parts.t);
  const fresh =
    Number.isInteger(timestamp) &&
    Math.abs(Math.floor(Date.now() / 1000) - timestamp) <= TOLERANCE_SECONDS;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(raw)
    .digest("hex");
  const signature = parts.v1 ?? "";
  const ok =
    fresh &&
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!ok) return new Response("Invalid signature", { status: 400 });

  if (await alreadyReceived(eventId)) return new Response("Duplicate", { status: 200 });

  const event = JSON.parse(raw.toString("utf8"));
  await enqueue(eventId, eventType, event); // don't block the response
  return new Response("OK", { status: 200 });
}

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["POCKETSFLOW_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 5 * 60

@app.post("/webhooks/pocketsflow")
def pocketsflow_webhook():
    raw = request.get_data()  # raw bytes, before parsing
    header = request.headers.get("X-Pocketsflow-Signature-V2", "")
    event_id = request.headers.get("X-Pocketsflow-Event-Id", "")
    event_type = request.headers.get("X-Pocketsflow-Event", "")

    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        timestamp = int(parts["t"])
    except (KeyError, ValueError):
        abort(400, "Invalid signature")
    if abs(int(time.time()) - timestamp) > TOLERANCE_SECONDS:
        abort(400, "Stale timestamp")

    expected = hmac.new(SECRET, f"{timestamp}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(parts.get("v1", ""), expected):
        abort(400, "Invalid signature")

    if already_received(event_id):
        return "Duplicate", 200

    event = request.get_json()
    enqueue(event_id, event_type, event)  # process in the background
    return "OK", 200

<?php
$raw = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_POCKETSFLOW_SIGNATURE_V2'] ?? '';
$eventId = $_SERVER['HTTP_X_POCKETSFLOW_EVENT_ID'] ?? '';
$eventType = $_SERVER['HTTP_X_POCKETSFLOW_EVENT'] ?? '';
$secret = getenv('POCKETSFLOW_WEBHOOK_SECRET');
$tolerance = 5 * 60;

$parts = [];
foreach (explode(',', $header) as $part) {
    [$key, $value] = array_pad(explode('=', $part, 2), 2, '');
    $parts[$key] = $value;
}
$timestamp = (int) ($parts['t'] ?? 0);
if ($timestamp === 0 || abs(time() - $timestamp) > $tolerance) {
    http_response_code(400);
    exit('Invalid signature');
}

$expected = hash_hmac('sha256', $timestamp . '.' . $raw, $secret);
if (!hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(400);
    exit('Invalid signature');
}

if (already_received($eventId)) {
    http_response_code(200);
    exit('Duplicate');
}

$event = json_decode($raw, true);
enqueue($eventId, $eventType, $event); // process asynchronously
http_response_code(200);
echo 'OK';

{
  "message": "Test webhook delivery failed",
  "event": "order.completed",
  "eventId": "evt_5f1c2a9b3e4a0012abcd0d0e",
  "delivered": false,
  "status": 401,
  "durationMs": 182,
  "error": "HTTP 401"
}