Kontraktr™ API Reference

import crypto from "crypto";

function verifyWebhookSignature(
  body: string,
  signature: string,
  timestamp: string,
  secret: string
): boolean {
  const payload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(`sha256=${expected}`),
    Buffer.from(signature)
  );
}

// In your Express/Next.js handler:
app.post("/webhook", (req, res) => {
  const sig = req.headers["x-webhook-signature"];
  const ts = req.headers["x-webhook-timestamp"];
  const valid = verifyWebhookSignature(
    JSON.stringify(req.body), sig, ts, process.env.WEBHOOK_SECRET
  );
  if (!valid) return res.status(401).send("Invalid signature");
  // Process event...
  res.status(200).send("OK");
});