Webhooks API: Receive Real-Time Outreach Events in Topo

import hashlib
import hmac

def verify_topo_signature(
    raw_body: bytes,
    signature_header: str,
    secret: str,
) -> bool:
    """Return True if the request signature is valid."""
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)


# Flask example
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_••••••••••••••••"

@app.route("/topo-events", methods=["POST"])
def topo_webhook():
    signature = request.headers.get("X-Topo-Signature", "")
    if not verify_topo_signature(request.get_data(), signature, WEBHOOK_SECRET):
        abort(401)

    payload = request.get_json()
    event_type = payload["type"]
    # handle event_type ...
    return "", 204

const crypto = require("crypto");

/**
 * Returns true if the request signature is valid.
 * @param {Buffer} rawBody  - The raw (unparsed) request body.
 * @param {string} signatureHeader - Value of the X-Topo-Signature header.
 * @param {string} secret - Your webhook signing secret.
 */
function verifyTopoSignature(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  // Use timingSafeEqual to prevent timing attacks
  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(signatureHeader, "utf8");
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

// Express example
const express = require("express");
const app = express();
const WEBHOOK_SECRET = "whsec_••••••••••••••••";

app.post(
  "/topo-events",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-topo-signature"] || "";
    if (!verifyTopoSignature(req.body, signature, WEBHOOK_SECRET)) {
      return res.status(401).send("Invalid signature");
    }

    const payload = JSON.parse(req.body);
    const eventType = payload.type;
    // handle eventType ...
    res.status(204).send();
  }
);