import crypto from 'crypto';
function verifyWebhook(payload: string, signature: string, secret: string): boolean {
const expected = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return `sha256=${expected}` === signature;
}
// In your handler:
app.post('/hubify/webhook', (req, res) => {
const sig = req.headers['x-hubify-signature'];
if (!verifyWebhook(req.rawBody, sig, process.env.HUBIFY_WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature');
}
// Handle event
const event = req.body;
console.log('Received:', event.type);
res.status(200).send('ok');
});