Webhooks

{
  "id": "01952d3f-...",
  "type": "deploy_ended",
  "timestamp": "2026-08-05T12:00:00Z",
  "data": {
    "id": "<deployment uuid>",
    "app_id": "<app uuid>",
    "app_name": "my-api-x7k2p",
    "status": "completed",
    "commit_sha": "abc123",
    "commit_message": "Fix the thing",
    "branch": "main",
    "created_at": "2026-08-05T11:58:00Z"
  }
}

const crypto = require("crypto");

function verify(headers, rawBody, secret) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];

  // Reject anything older than five minutes - this is what makes a captured
  // request non-replayable.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const key = Buffer.from(secret.replace("whsec_", ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest("base64");

  return headers["webhook-signature"]
    .split(" ")
    .map((part) => part.split(",")[1])
    .some(
      (signature) =>
        signature.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    );
}