Webhooks Documentation

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler:
app.post('/webhooks/sentiments', (req, res) => {
  const signature = req.headers['x-sentiments-signature'];
  const timestamp = req.headers['x-sentiments-timestamp'];
  const rawBody = req.rawBody; // Use raw body, not parsed JSON

  // Check timestamp is within 5 minutes
  const age = Date.now() / 1000 - parseInt(timestamp);
  if (age > 300) {
    return res.status(401).send('Webhook expired');
  }

  if (!verifyWebhook(rawBody, signature, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(rawBody);
  // Process the event...

  res.status(200).send('OK');
});