Webhooks

{
  "conversation_id": "3c5b1e77-90aa-4c0e-8f71-1d2a3b4c5d6e",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "whatsapp_message_id": "wamid.HBgMOTE5ODc2NTQzMjEwFQIAERgS",
  "content_type": "text",
  "text": "Has it shipped yet?"
}

{
  "channel": "instagram",
  "conversation_id": "3c5b1e77-90aa-4c0e-8f71-1d2a3b4c5d6e",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "instagram_message_id": "aWdfZG1fMTpc",
  "content_type": "text",
  "text": "Is this still available?"
}

{
  "channel": "web",
  "conversation_id": "3c5b1e77-90aa-4c0e-8f71-1d2a3b4c5d6e",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "message_id": "1f2e3d4c-5b6a-4978-8695-a4b3c2d1e0f9",
  "content_type": "text",
  "text": "Do you deliver to Coimbatore?"
}

{
  "whatsapp_message_id": "wamid.HBgMOTE5ODc2NTQzMjEwFQIAERgS",
  "conversation_id": "3c5b1e77-90aa-4c0e-8f71-1d2a3b4c5d6e",
  "status": "delivered"
}

{
  "conversation_id": "3c5b1e77-90aa-4c0e-8f71-1d2a3b4c5d6e",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e"
}

{
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "phone": "+919876543210",
  "name": "Priya Nair"
}

{
  "form_id": "0b1c2d3e-4f5a-4b6c-8d7e-9f0a1b2c3d4e",
  "submission_id": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "source": "hosted",
  "data": {
    "full_name": "Priya Nair",
    "phone": "+919876543210",
    "course": "Weekend batch"
  }
}

{
  "booking_id": "9a8b7c6d-5e4f-4a3b-9c2d-1e0f9a8b7c6d",
  "form_id": "0b1c2d3e-4f5a-4b6c-8d7e-9f0a1b2c3d4e",
  "contact_id": "7e2d9c01-55b4-4a3d-9c8e-0f1a2b3c4d5e",
  "starts_at": "2026-10-21T05:30:00.000Z",
  "ends_at": "2026-10-21T06:00:00.000Z",
  "timezone": "Asia/Kolkata",
  "status": "confirmed"
}

import crypto from 'node:crypto';

const TOLERANCE_SECONDS = 300;

export function verifyWatxSignature(rawBody, header, secret) {
  if (!header) return false;

  const parts = Object.fromEntries(
    header.split(',').map((kv) => {
      const i = kv.indexOf('=');
      return [kv.slice(0, i).trim(), kv.slice(i + 1)];
    })
  );

  const t = Number(parts.t);
  const v1 = typeof parts.v1 === 'string' ? parts.v1.trim().toLowerCase() : '';
  if (!Number.isFinite(t) || !v1) return false;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');

  if (expected.length !== v1.length) return false;
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

// Express: keep the raw body.
// app.post('/hooks/watx', express.raw({ type: 'application/json' }), (req, res) => {
//   const ok = verifyWatxSignature(req.body.toString('utf8'), req.get('X-Watx-Signature'), process.env.WATX_WEBHOOK_SECRET);
//   if (!ok) return res.sendStatus(400);
//   const event = JSON.parse(req.body.toString('utf8'));
//   res.sendStatus(200);           // answer fast, then do the work
// });

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_watx_signature(raw_body: bytes, header: str, secret: str) -> bool:
    if not header:
        return False

    parts = {}
    for piece in header.split(","):
        key, _, value = piece.partition("=")
        parts[key.strip()] = value

    try:
        t = int(parts["t"])
        v1 = parts["v1"].strip().lower()
    except (KeyError, ValueError):
        return False

    if not v1 or abs(int(time.time()) - t) > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(
        secret.encode("utf-8"),
        f"{t}.".encode("utf-8") + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, v1)


# Flask: request.get_data() is the raw body.
# ok = verify_watx_signature(
#     request.get_data(),
#     request.headers.get("X-Watx-Signature", ""),
#     os.environ["WATX_WEBHOOK_SECRET"],
# )