Webhooki: zdarzenia do Twojego systemu

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.BROSBOTS_WEBHOOK_SECRET;

app.post("/webhooks/brosbots", express.raw({ type: "application/json" }), (req, res) => {
  const expected = "sha256=" + crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  const received = req.get("X-Brosbots-Signature") || "";
  const ok =
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const { event, data } = JSON.parse(req.body.toString("utf8"));
  // ... obsłuż zdarzenie
  res.status(204).end();
});

import hashlib
import hmac
import os

from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["BROSBOTS_WEBHOOK_SECRET"].encode()


@app.post("/webhooks/brosbots", status_code=204)
async def brosbots(request: Request, x_brosbots_signature: str = Header("")):
    body = await request.body()
    expected = "sha256=" + hmac.new(SECRET, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, x_brosbots_signature):
        raise HTTPException(status_code=401)
    payload = await request.json()
    # ... obsłuż payload["event"], payload["data"]

<?php
$secret = getenv('BROSBOTS_WEBHOOK_SECRET');
$body = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
$received = $_SERVER['HTTP_X_BROSBOTS_SIGNATURE'] ?? '';

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}
$payload = json_decode($body, true);
// ... obsłuż $payload['event'], $payload['data']
http_response_code(204);