Receive signed WhatsApp events.

import crypto from "node:crypto"
import express from "express"

const app = express()

app.post(
  "/webhooks/clickmaker",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const timestamp = req.header("X-ClickMaker-Timestamp") ?? ""
    const signature = req.header("X-ClickMaker-Signature") ?? ""
    const raw = req.body.toString("utf8")

    // Reject stale events (replay protection).
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
      return res.status(401).json({ error: "stale timestamp" })
    }

    const expected = crypto
      .createHmac("sha256", process.env.CLICKMAKER_WEBHOOK_SECRET!)
      .update(`${timestamp}.${raw}`)
      .digest("hex")

    const received = signature.replace(/^v1=/, "")
    const valid =
      received.length === expected.length &&
      crypto.timingSafeEqual(
        Buffer.from(expected, "hex"),
        Buffer.from(received, "hex"),
      )

    if (!valid) return res.status(401).json({ error: "invalid signature" })

    // Acknowledge fast; process asynchronously.
    res.status(200).json({ received: true })

    const event = JSON.parse(raw)
    queue.push(event) // deduplicate by event.id in your worker
  },
)

<?php
$raw = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_CLICKMAKER_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_CLICKMAKER_SIGNATURE'] ?? '';
$secret = getenv('CLICKMAKER_WEBHOOK_SECRET');

if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit('stale timestamp');
}

$expected = hash_hmac('sha256', $timestamp . '.' . $raw, $secret);
$received = preg_replace('/^v1=/', '', $signature);

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('invalid signature');
}

http_response_code(200);
echo json_encode(['received' => true]);