Outgoing webhooks

// Express.js example
app.post('/webhooks/partnero', (req, res) => {
  const { event, data } = req.body;
  
  // Process the event
  console.log(`Received ${event} event`);
  
  // Respond quickly with 200
  res.status(200).send('OK');
  
  // Process asynchronously if needed
  processWebhookAsync(event, data);
});

const crypto = require('crypto');

// IMPORTANT: capture the raw body, do NOT use express.json() on this route
app.post(
  '/webhooks/partnero',
  express.raw({ type: '*/*' }),
  (req, res) => {
    const received = req.get('Signature'); // header name is "Signature"
    const expected = crypto
      .createHmac('sha256', WEBHOOK_SECRET) // your webhook's signing secret
      .update(req.body)                     // raw Buffer, exactly as received
      .digest('hex');

    const valid =
      received &&
      received.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));

    if (!valid) {
      return res.status(401).send('Invalid signature');
    }

    const payload = JSON.parse(req.body.toString('utf8'));
    // payload = { event, url, webhook_key, created_at, data }

    res.status(200).send('OK');
  }
);

<?php
// PHP example
$raw = file_get_contents('php://input');
$expected = hash_hmac('sha256', $raw, $webhookSecret);

if (!hash_equals($expected, $_SERVER['HTTP_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit('Invalid signature');
}

$payload = json_decode($raw, true);
// $payload = ['event' => ..., 'url' => ..., 'webhook_key' => ..., 'created_at' => ..., 'data' => [...]]