Documentación

const express = require('express');
const crypto = require('crypto');
const app = express();

// Middleware to capture raw body for signature verification
app.use('/webhook/soundmadeseen', express.raw({ type: 'application/json' }));

// Webhook endpoint
app.post('/webhook/soundmadeseen', (req, res) => {
    try {
        // Verify the webhook signature (recommended)
        const signature = req.headers['x-webhook-signature'];
        const secret = 'your_webhook_secret_here'; // From webhook creation response
        
        if (signature && verifySignature(req.body, signature, secret)) {
            // Process the webhook
            const data = JSON.parse(req.body.toString());
            
            if (data.event === 'video.rendered') {
                const videoId = data.data.video_id;
                const downloadUrl = data.data.download_url;
                // Handle completed video...
                console.log(`Video rendered: ${videoId}, URL: ${downloadUrl}`);
                
            } else if (data.event === 'audio.processed') {
                const audioId = data.data.audio_id;
                // Handle processed audio...
                console.log(`Audio processed: ${audioId}`);
            }
            
            res.status(200).send('OK');
        } else {
            res.status(401).send('Unauthorized');
        }
    } catch (error) {
        console.error('Webhook error:', error);
        res.status(400).send('Bad Request');
    }
});

function verifySignature(body, signature, secret) {
    const expected = crypto
        .createHmac('sha256', secret)
        .update(body)
        .digest('hex');
    
    return crypto.timingSafeEqual(
        Buffer.from(`sha256=${expected}`),
        Buffer.from(signature)
    );
}

// Start server
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`Webhook server running on port ${PORT}`);
});

<?php
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret = 'your_webhook_secret_here'; // From webhook creation response

if ($signature && verifySignature($body, $signature, $secret)) {
    // Process the webhook
    $data = json_decode($body, true);
    
    if ($data === null) {
        http_response_code(400);
        exit('Invalid JSON');
    }
    
    if ($data['event'] === 'video.rendered') {
        $videoId = $data['data']['video_id'];
        $downloadUrl = $data['data']['download_url'];
        // Handle completed video...
        error_log("Video rendered: $videoId, URL: $downloadUrl");
        
    } elseif ($data['event'] === 'audio.processed') {
        $audioId = $data['data']['audio_id'];
        // Handle processed audio...
        error_log("Audio processed: $audioId");
    }
    
    http_response_code(200);
    echo 'OK';
} else {
    http_response_code(401);
    exit('Unauthorized');
}

function verifySignature($body, $signature, $secret) {
    $expected = hash_hmac('sha256', $body, $secret);
    $expectedSignature = "sha256=$expected";
    
    return hash_equals($expectedSignature, $signature);
}

const crypto = require('crypto');

function verifyWebhookSignature(body, signature, secret) {
    /**
     * Verify webhook signature
     * @param {Buffer|string} body - Raw request body
     * @param {string} signature - Signature from X-Webhook-Signature header
     * @param {string} secret - Webhook secret
     * @returns {boolean} - True if signature is valid
     */
    const expectedSignature = crypto
        .createHmac('sha256', secret)
        .update(body)
        .digest('hex');
    
    const expectedSignatureWithPrefix = `sha256=${expectedSignature}`;
    
    return crypto.timingSafeEqual(
        Buffer.from(expectedSignatureWithPrefix),
        Buffer.from(signature)
    );
}

// Usage example with Express.js
const express = require('express');
const app = express();

// Use raw middleware to get the body as Buffer for signature verification
app.use(express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
    const signature = req.headers['x-webhook-signature'];
    const secret = 'your_webhook_secret'; // From webhook creation
    const body = req.body; // This is a Buffer when using express.raw()
    
    if (verifyWebhookSignature(body, signature, secret)) {
        // Webhook is authentic
        processWebhook(body);
        res.status(200).send('OK');
    } else {
        // Reject the webhook
        res.status(401).send('Unauthorized');
    }
});

function processWebhook(body) {
    // Parse and process the webhook data
    const data = JSON.parse(body.toString());
    console.log('Processing webhook:', data);
    // Your webhook processing logic here
}

// Alternative usage with raw string body (if you're not using Express)
function exampleUsage() {
    const signature = 'sha256=abcd1234...'; // From request headers
    const secret = 'your_webhook_secret';
    const body = '{"event": "test", "data": {}}'; // Raw request body as string
    
    if (verifyWebhookSignature(body, signature, secret)) {
        console.log('Webhook signature is valid');
        processWebhook(body);
    } else {
        console.log('Invalid webhook signature');
    }
}

<?php

function verifyWebhookSignature($body, $signature, $secret) {
    /**
     * Verify webhook signature
     * @param string $body - Raw request body
     * @param string $signature - Signature from X-Webhook-Signature header
     * @param string $secret - Webhook secret
     * @return bool - True if signature is valid
     */
    $expectedSignature = hash_hmac('sha256', $body, $secret);
    $expectedSignatureWithPrefix = "sha256=" . $expectedSignature;
    
    return hash_equals($expectedSignatureWithPrefix, $signature);
}

// Usage example
function handleWebhook() {
    $signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
    $secret = 'your_webhook_secret'; // From webhook creation
    $body = file_get_contents('php://input'); // Raw request body
    
    if (verifyWebhookSignature($body, $signature, $secret)) {
        // Webhook is authentic
        processWebhook($body);
        http_response_code(200);
        echo 'OK';
    } else {
        // Reject the webhook
        http_response_code(401);
        echo 'Unauthorized';
    }
}

function processWebhook($body) {
    // Parse and process the webhook data
    $data = json_decode($body, true);
    
    if ($data === null) {
        error_log('Invalid JSON in webhook body');
        return;
    }
    
    error_log('Processing webhook: ' . print_r($data, true));
    // Your webhook processing logic here
}

// Example usage in a webhook endpoint
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    handleWebhook();
} else {
    http_response_code(405);
    echo 'Method Not Allowed';
}

// Alternative standalone usage example
function exampleUsage() {
    $signature = 'sha256=abcd1234...'; // From request headers
    $secret = 'your_webhook_secret';
    $body = '{"event": "test", "data": {}}'; // Raw request body
    
    if (verifyWebhookSignature($body, $signature, $secret)) {
        echo "Webhook signature is valid\n";
        processWebhook($body);
    } else {
        echo "Invalid webhook signature\n";
    }
}

?>